May 2019 – Welcome

May 28, 2019June 25, 2019

Information Gathering

Information gathering is to collect as much information about our target, such as Domain Name Server (DNS) hostnames, IP address, and etc.

1. whois –> To gather information about the domain and the registrant.

The command is very simple –> whois *website*

2. theHarvester –> To gather email account, username, and hostname.
If we want gather information using theHarvester, with maximum 100 results and using google the command is theharvester -d domain.com -l 100 -b google

3. dig -> Dig (Domain Information Groper) is a network administration command-line tool for querying DNS name servers. It is useful for verifying and troubleshooting DNS problems and also to perform DNS lookups and displays the answers that are returned from the name server that was queried. The command is dig *website*

May 10, 2019June 25, 2019

Kali Linux Penetration Testing Cycle

1 Target scoping

In this step, we observe the network condition and determine what to do. What objectives we need to achieve, how long does the test going to take, etc.

2 Information Gathering

Gather and learn about the target from public sources, such as Google, Yahoo!, and many more. Information gathering can also be done with footprinting tools.

3 Target discovery

in this step, we mostly deal with identifying the target’s network status, OS, and network architecture.

4 Enumerating target

Find open ports of the target. Once the open ports have been identified, they can be enumerated
for the running services.

5 Vulnerability mapping

Identify the weakness of the target based on the disclosed ports and services.

6 Social Engineering

Manipulate target into executing malicious code that gives access to the auditor. This step is optional.

7 Target exploitation

In this step, we really penetrate into the system. This step focused on the target acquisition process that has three core area, includes pre-exploitation, exploitation, and post-exploitation activities.

8 Privilege Escalation

The goal of this step is gaining the highest level access of the target.

9 Maintaining Access

Keeping control of the target for a specified amount of time. Provides a clear view of how an attacker maintains access without noisy behavior.

10 Documentation and Reporting

Documenting, reporting, and presenting the vulnerabilities found.

May 10, 2019June 25, 2019

Google Dorks

A Google Dork query, sometimes just referred to as a dork, is a search string that uses advanced search operators to find information that is not readily available on a website. In other words, we can use Google Dorks to find vulnerabilities, hidden information and access pages on certain websites.

Google Dorks can uncover some incredible information such as email addresses and lists, login credentials, sensitive files, website vulnerabilities, and even financial information (e.g. payment card data).

Some of the popular operators used for Google Hacking:

inurl: ” ” Used to find a specified term in the url.
- Example: Using inurl: “google dorks”, Google will only show the term “google dorks” on their results page.

allinurl: ” ” –> Similar to inurl, but show the results for the URL that meet all the keyword.
intitle: ” ” –>Using this operator, Google will only show the results that have the specified term in their website title.
- Example: When using intitle: “login page”, Google will only show the sites that have the word “login page” in the website’s title text.
allintitle: ” ” –> Similar to intitle, but using this operator, Google will show all the specified keywords in the title.
site: www.web.com –>To limit the result to only a specific site only
Related: www.web.com –> To find similar sites to the term of the domain
filetype: –> To find a specific file type (Ex: .pdf, .mp4, .php)
ext: –> Similar to filetype, but only shows the results that is based on the searched file extension.