1. 포트 정보 검색
- 주소 뒤에 포트 번호넣어주면 바로 나옴
https://www.speedguide.net/port.php?port=
2. nmap 옵션
-sV
-sC
3. dir 버스팅 워드리스트
https://github.com/danielmiessler/SecLists
GitHub - danielmiessler/SecLists: SecLists is the security tester's companion. It's a collection of multiple types of lists used
SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, ...
github.com
4. vhost 지정
echo "{target_IP} 호스트명" | sudo tee -a /etc/hosts
5. shell 획득 헷갈림
6. GTFOBins & LOLBAS
: 특정 리눅스 명령어(바이너리)를 이용해서 권한 상승, 쉘 획득, 파일 읽기 등을 하는 방법을 정리한 데이터베이스 사이트
> GTFOBins
GTFOBins
GTFOBins is a curated list of Unix-like executables that can be used to bypass local security restrictions in misconfigured systems.
gtfobins.org
> LOLBAS
https://lolbas-project.github.io/
LOLBAS
lolbas-project.github.io
7. gobuster
sudo gobuster dir -w /usr/share/wordlists/dirb/common.txt -u 10.129.44.129
gobuster dir --url http://{TARGET_IP}/ --wordlist
/usr/share/wordlists/dirbuster/directory-list-2.3-small.txt -x php
8. 리버스 셸에서 기능 강화(보통 www-data일 때)
python3 -c 'import pty;pty.spawn("/bin/bash")'=> 불편한 셸을 진짜 shell처럼 업글해줌.
[그 외 참고하기 좋은 사이트]
1. OWASP Top 10
https://owasp.org/www-project-top-ten/
OWASP Top Ten Web Application Security Risks | OWASP Foundation
The OWASP Top 10 is the reference standard for the most critical web application security risks. Adopting the OWASP Top 10 is perhaps the most effective first step towards changing your software development culture focused on producing secure code.
owasp.org