Nuclei

cat host.txt | naabu -p 80,443 - retries 1 -c 10 | /usr/bin/httpx -silent | nuclei -t /home/consultor/nuclei-templates/ -me salida

Kill

w
ps -ft pts/42
pkill -9 -t pts/42

Audit process

apt-get install auditd
auditctl -a task,always
ausearch -i -sc execve

Sites

fuzzysecurity.com : exploit windows
etutorials.org/Networking : can see IDS tutorial
pentestmonkey.net : cheatsheet
exploit-db.com/papers : article on how to exploit

Host, whois : dnslookup

getent hosts google.com
nc -vz 127.0.0.1 8080
iptables -F -t nat
SMTP

cat /etc/resolv.conf netstat -laputn nslookup debian.com # better than ping

route -n
dig -t txt example.com
host
whois

$ host www.facebook.com
www.facebook.com is an alias for star.c10r.facebook.com.
star.c10r.facebook.com has address 31.13.64.1
star.c10r.facebook.com has IPv6 address 2a03:2880:10:8f01:face:b00c::9
star.c10r.facebook.com mail is handled by 10 msgin.t.facebook.com.

$ whois -h whois.radb.net 31.13.64.1
route:      31.13.64.0/24
descr:      Facebook, Inc.
origin:     AS32934
mnt-by:     MAINT-AS32934
changed:    jj@fb.com 20111025
source:     RADB

$ whois -h whois.radb.net '!gAS32934' | tr " " "\n" | sort -n -t . -k 1,1 -k 2,2 -k 3,3 -k 4,4 
A939
C
31.13.24.0/21
31.13.64.0/18
...

Wifi strengh

watch -n1 iwconfig

Firewall building

ping somehostname.com -4 iptables -A INPUT -s IP-ADDRESS -j DROP iptables -A INPUT -s 65.55.44.100 -j DROP

Firefox cache

I’ve found for Firefox that quitting and restarting works. The relevant settings in about:config are network.dnsCacheEntries and network.dnsCacheExpiration, which can be set to 0 in order to disable caching. Then delete cache in configs.

Nmap : scan network

nmap -sP 192.168.2.1/24
nmap -sn 192.168.2.1/24 # oter protocol
- Tries to ping : can be blocked by a firewall
sudo nmap -sP -PS22,3389 192.168.2.1/24 #custom TCP SYN scan
sudo nmap -sP -PU161 192.168.2.1/24 #custom UDP scan
nmap -A -T4 localhost

Arp resolve hosts, Adress Resolution Protocol

arp -vn # resolves hostnames after having nmapped them
arp -a -n This lists all hosts which responded to an ARP query, even the ones which filter ICMP.

Ssh sercer

sudo apt install openssh-server
sudo service ssh start
- Gives me a remote hostname so people can connect with my name and not IP
/etc/init.d/ssh start
ssh user@192.168.0.1

Pentest