Initial Access Tactics, techniques and procedures - Revision history

Quetzalcoatl: /* Services */

2025-07-22T17:11:07Z

Services

← Older revision		Revision as of 17:11, 22 July 2025
Line 72:		Line 72:

	* https://haveibeenpwned.com		* https://haveibeenpwned.com
	* https://~~exposed~~.~~lol~~		* https://stealerlo.gs/
	* https://leak-lookup.com [Paid. Accepts crypto (XMR & BTC)]		* https://leak-lookup.com [Paid. Accepts crypto (XMR & BTC)]
	* https://dehashed.com [Paid. Accepts crypto (BTC)]		* https://dehashed.com [Paid. Accepts crypto (BTC)]

Booda at 11:55, 8 October 2024

2024-10-08T11:55:20Z

← Older revision		Revision as of 11:55, 8 October 2024
Line 117:		Line 117:
	As seen by [https://enlacehacktivista.org/hackback2.webm Guacamaya], hacktivists can benefit from a highly targeted spray and pray campaign whereby you scan IP ranges of countries of interest or your target companies IP ranges for critical vulnerabilities and attack protocols with a password attack. In the case of Guacamaya they scanned and exploited proxyshell and yoinked all their target e-mails out of their Microsoft exchange e-mail servers and leaked them. You can also do the same! See [https://enlacehacktivista.org/index.php?title=Scanning_and_Recon scanning and recon] for tools such as [https://github.com/projectdiscovery/nuclei nuclei] and the [https://nmap.org/book/nse.html nmap scripting engine] (NSE) to then vulnerability scan the IP addresses you discover.		As seen by [https://enlacehacktivista.org/hackback2.webm Guacamaya], hacktivists can benefit from a highly targeted spray and pray campaign whereby you scan IP ranges of countries of interest or your target companies IP ranges for critical vulnerabilities and attack protocols with a password attack. In the case of Guacamaya they scanned and exploited proxyshell and yoinked all their target e-mails out of their Microsoft exchange e-mail servers and leaked them. You can also do the same! See [https://enlacehacktivista.org/index.php?title=Scanning_and_Recon scanning and recon] for tools such as [https://github.com/projectdiscovery/nuclei nuclei] and the [https://nmap.org/book/nse.html nmap scripting engine] (NSE) to then vulnerability scan the IP addresses you discover.

	=== ~~Prerequisites~~ ===		=== Networks ===
	~~There are some prerequisites you will need to follow the below examples:~~
	~~# Virtual or Dedicated server ([https://enlacehacktivista.org/index.php?title=Opsec_Measures OPSEC])~~
	~~# Basic [https://www.hackthebox.com/blog/learn-linux command line knowledge]~~
	~~# Terminal multiplexers such as [https://github.com/tmux/tmux/wiki Tmux] or [https://www.gnu.org/software/screen/ Gnu/Screen] to maintain your scanning and hacking session~~
	~~# Administration skills such as [https://www.redhat.com/sysadmin/eight-ways-secure-ssh SSH] and [https://www.ssh.com/academy/ssh/scp#basic-usage SCP].~~

	~~=== Networks ===~~
	==== Vulnerability Scanning ====		==== Vulnerability Scanning ====
	We can use a vulnerability scanning spray and pray technique on [https://attack.mitre.org/techniques/T1190 publicly facing applications] to masscan the internet or specific IP ranges for critical vulnerabilities that we can later exploit and gain initial access into target networks with. Here we scan for and exploit both Proxyshell and CVE-2018-13379 as they are both high severity and critical CVE vulnerabilities. In your attacks focus on [https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-215a new] and [https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-117a old] CVE vulnerabilities that are commonly exploited.		We can use a vulnerability scanning spray and pray technique on [https://attack.mitre.org/techniques/T1190 publicly facing applications] to masscan the internet or specific IP ranges for critical vulnerabilities that we can later exploit and gain initial access into target networks with. Here we scan for and exploit both Proxyshell and CVE-2018-13379 as they are both high severity and critical CVE vulnerabilities. In your attacks focus on [https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-215a new] and [https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-117a old] CVE vulnerabilities that are commonly exploited.

	Here we port scan IP ranges for either the entire internet or specific country IP ranges, append those ports to the end of the IP address separated with a colon and then proceed to vulnerability scan the discovered hosts before finally exploiting the identified vulnerabilities.		Here we port scan IP ranges for either the entire internet or specific country IP ranges, append those ports to the end of the IP address separated with a colon and then proceed to vulnerability scan the discovered hosts before finally exploiting the identified vulnerabilities.

			If the output from the scans is too large, then you can use the [https://linux.die.net/man/1/split split] command to break the output file up into smaller files and scan against those via multiple [https://linux.die.net/man/1/screen screen] windows/sessions to make your scanning more efficient.

			* <code>split -l 10000 results.txt results_</code>

	'''IP Ranges''':		'''IP Ranges''':

Booda: /* Buying access */

2024-03-30T12:22:23Z

Buying access

← Older revision		Revision as of 12:22, 30 March 2024
Line 112:		Line 112:
	* https://xss.is ([http://xssforumv3isucukbxhdhwz67hoa5e2voakcfkuieq4ch257vsburuid.onion Tor])		* https://xss.is ([http://xssforumv3isucukbxhdhwz67hoa5e2voakcfkuieq4ch257vsburuid.onion Tor])
	* https://exploit.in [Paid] ([https://exploitivzcm5dawzhe6c32bbylyggbjvh5dyvsvb5lkuz5ptmunkmqd.onion Tor])		* https://exploit.in [Paid] ([https://exploitivzcm5dawzhe6c32bbylyggbjvh5dyvsvb5lkuz5ptmunkmqd.onion Tor])
			* https://ramp4u.io [Free & Paid] ([http://rampjcdlqvgkoz5oywutpo6ggl7g6tvddysustfl6qzhr5osr24xxqqd.onion Tor])

	== Spray and pray ==		== Spray and pray ==

Booda: /* Common and leaked passwords */

2024-03-30T12:19:36Z

Common and leaked passwords

← Older revision		Revision as of 12:19, 30 March 2024
Line 52:		Line 52:
	* https://github.com/danielmiessler/SecLists/tree/master/Passwords/Leaked-Databases		* https://github.com/danielmiessler/SecLists/tree/master/Passwords/Leaked-Databases
	* https://github.com/brannondorsey/naive-hashcat/releases/download/data/rockyou.txt		* https://github.com/brannondorsey/naive-hashcat/releases/download/data/rockyou.txt
			* https://github.com/projectdiscovery/nuclei-templates/tree/main/helpers/wordlists

	=== Password cracking tools ===		=== Password cracking tools ===

Booda: /* Services */

2024-03-30T12:12:09Z

Services

← Older revision		Revision as of 12:12, 30 March 2024
Line 71:		Line 71:

	* https://haveibeenpwned.com		* https://haveibeenpwned.com
			* https://exposed.lol
	* https://leak-lookup.com [Paid. Accepts crypto (XMR & BTC)]		* https://leak-lookup.com [Paid. Accepts crypto (XMR & BTC)]
	* https://dehashed.com [Paid. Accepts crypto (BTC)]		* https://dehashed.com [Paid. Accepts crypto (BTC)]

Booda: /* Vulnerability Scanning */

2024-03-25T17:12:09Z

Vulnerability Scanning

← Older revision		Revision as of 17:12, 25 March 2024
Line 128:		Line 128:

	'''IP Ranges''':		'''IP Ranges''':
	* List ~~all~~ IP ranges from popular cloud providers: https://kaeferjaeger.gay/?dir=ip-ranges		* List of IP ranges from popular cloud providers: https://kaeferjaeger.gay/?dir=ip-ranges
	* IP Address Ranges by Country: https://lite.ip2location.com/ip-address-ranges-by-country ([https://github.com/ip2location/ip2location-python-csv-converter parse output])
	* CIDR country-level IP data, straight from the Regional Internet Registries, updated hourly: https://github.com/herrbischoff/country-ip-blocks		* CIDR country-level IP data, straight from the Regional Internet Registries, updated hourly: https://github.com/herrbischoff/country-ip-blocks
	* [https://github.com/robertdavidgraham/masscan#how-to-scan-the-entire-internet Scan the entire internet:] 0.0.0.0/0		* [https://github.com/robertdavidgraham/masscan#how-to-scan-the-entire-internet Scan the entire internet:] 0.0.0.0/0

Booda: /* VPN */

2024-03-25T17:11:10Z

VPN

← Older revision		Revision as of 17:11, 25 March 2024
Line 184:		Line 184:
	'''2.''' Virtual Private Network (VPN) Brute forcing:		'''2.''' Virtual Private Network (VPN) Brute forcing:
	<br>		<br>
	* <code>sudo [https://github.com/robertdavidgraham/masscan masscan] -Pn -sS -iL [https://enlacehacktivista.org/images/4/4b/Latin_american_ranges.txt ranges.txt] --rate 50000 -p10443,443 --open-only --excludefile [https://gist.github.com/ozuma/fb21ab0f7143579b1f2794f4af746fb2 block.txt] \| grep -Eo '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+' > results.txt></code>		* <code>sudo [https://github.com/robertdavidgraham/masscan masscan] -Pn -sS -iL [https://enlacehacktivista.org/images/4/4b/Latin_american_ranges.txt ranges.txt] --rate 50000 -p10443,443 --open-only --excludefile [https://gist.github.com/ozuma/fb21ab0f7143579b1f2794f4af746fb2 block.txt] \| grep -Eo '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+' > results.txt</code>
	* To brute-force see: https://enlacehacktivista.org/index.php?title=VPN_brute_forcing		* To brute-force see: https://enlacehacktivista.org/index.php?title=VPN_brute_forcing

Booda: /* RDP */

2024-03-25T17:11:00Z

RDP

← Older revision		Revision as of 17:11, 25 March 2024
Line 178:		Line 178:
	'''1.''' [https://github.com/galkan/crowbar Remote Desktop (RDP) Brute forcing]:		'''1.''' [https://github.com/galkan/crowbar Remote Desktop (RDP) Brute forcing]:
	<br>		<br>
	* <code>sudo [https://github.com/robertdavidgraham/masscan masscan] -Pn -sS -iL [https://enlacehacktivista.org/images/4/4b/Latin_american_ranges.txt ranges.txt] --rate 50000 -p3389 --open-only --excludefile [https://gist.github.com/ozuma/fb21ab0f7143579b1f2794f4af746fb2 block.txt] \| grep -Eo '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+' > results.txt></code>		* <code>sudo [https://github.com/robertdavidgraham/masscan masscan] -Pn -sS -iL [https://enlacehacktivista.org/images/4/4b/Latin_american_ranges.txt ranges.txt] --rate 50000 -p3389 --open-only --excludefile [https://gist.github.com/ozuma/fb21ab0f7143579b1f2794f4af746fb2 block.txt] \| grep -Eo '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+' > results.txt</code>
	* <code>[https://github.com/vanhauser-thc/thc-hydra hydra] -L [https://github.com/danielmiessler/SecLists/tree/master/Usernames usernames.txt] -P [https://github.com/danielmiessler/SecLists/tree/master/Passwords passwords.txt] -M targets.txt -t 16 rdp -o results</code>		* <code>[https://github.com/vanhauser-thc/thc-hydra hydra] -L [https://github.com/danielmiessler/SecLists/tree/master/Usernames usernames.txt] -P [https://github.com/danielmiessler/SecLists/tree/master/Passwords passwords.txt] -M targets.txt -t 16 rdp -o results</code>

Mxwgn: mini fix

2023-11-27T08:22:01Z

mini fix

← Older revision		Revision as of 08:22, 27 November 2023
Line 1:		Line 1:
	== Phishing ==		== Phishing ==
	[https://www.frontiersin.org/articles/10.3389/fcomp.2021.563060/full Phishing] is the most common attack method favored by advanced persistent threat groups and cyber criminal organized gangs. This is because it relies on social engineering to trick the target to either download a malicious ~~email~~ attachment or click on a malicious link.		[https://www.frontiersin.org/articles/10.3389/fcomp.2021.563060/full Phishing] is the most common attack method favored by advanced persistent threat groups and cyber criminal organized gangs. This is because it relies on social engineering to trick the target to either download a malicious e-mail attachment or click on a malicious link.

	==== Tools ====		==== Tools ====
Line 27:		Line 27:

	=== Usernames ===		=== Usernames ===
	Create a bespoke username word list based on OSINT, recon, permutations and your targets employee LinkedIn, website and other social media profiles to aid in your password attacks to develop possible usernames and ~~emails~~ for password spraying.		Create a bespoke username word list based on OSINT, recon, permutations and your targets employee LinkedIn, website and other social media profiles to aid in your password attacks to develop possible usernames and e-mails for password spraying.

	* https://github.com/digininja/CeWL		* https://github.com/digininja/CeWL
Line 74:		Line 74:
	* https://dehashed.com [Paid. Accepts crypto (BTC)]		* https://dehashed.com [Paid. Accepts crypto (BTC)]

	Once your leaks have been downloaded you can [https://archive.ph/C8tI2 parse] your results in the format, ~~email~~:pass.		Once your leaks have been downloaded you can [https://archive.ph/C8tI2 parse] your results in the format, e-mail:pass.

	=== Password spraying ===		=== Password spraying ===
Line 112:		Line 112:

	== Spray and pray ==		== Spray and pray ==
	As seen by [https://enlacehacktivista.org/hackback2.webm Guacamaya], hacktivists can benefit from a highly targeted spray and pray campaign whereby you scan IP ranges of countries of interest or your target companies IP ranges for critical vulnerabilities and attack protocols with a password attack. In the case of Guacamaya they scanned and exploited proxyshell and yoinked all their target ~~emails~~ out of their Microsoft exchange ~~email~~ servers and leaked them. You can also do the same! See [https://enlacehacktivista.org/index.php?title=Scanning_and_Recon scanning and recon] for tools such as [https://github.com/projectdiscovery/nuclei nuclei] and the [https://nmap.org/book/nse.html nmap scripting engine] (NSE) to then vulnerability scan the IP addresses you discover.		As seen by [https://enlacehacktivista.org/hackback2.webm Guacamaya], hacktivists can benefit from a highly targeted spray and pray campaign whereby you scan IP ranges of countries of interest or your target companies IP ranges for critical vulnerabilities and attack protocols with a password attack. In the case of Guacamaya they scanned and exploited proxyshell and yoinked all their target e-mails out of their Microsoft exchange e-mail servers and leaked them. You can also do the same! See [https://enlacehacktivista.org/index.php?title=Scanning_and_Recon scanning and recon] for tools such as [https://github.com/projectdiscovery/nuclei nuclei] and the [https://nmap.org/book/nse.html nmap scripting engine] (NSE) to then vulnerability scan the IP addresses you discover.

	=== Prerequisites ===		=== Prerequisites ===
Line 154:		Line 154:
	'''Tool''': [https://github.com/zmap/zmap zmap]		'''Tool''': [https://github.com/zmap/zmap zmap]

	'''1.''' Scan for Microsoft Exchange ~~Email~~ Servers:		'''1.''' Scan for Microsoft Exchange E-mail Servers:
	<pre>		<pre>
	sudo zmap -q -p 443 \| httpx -silent -s -sd -location \		sudo zmap -q -p 443 \| httpx -silent -s -sd -location \

Enlacehacktivista: /* Buying access */

2023-11-09T17:57:08Z

Buying access

← Older revision		Revision as of 17:57, 9 November 2023
Line 103:		Line 103:
	== Buying access ==		== Buying access ==

	You can use the ~~genesis~~ market to purchase credentials stolen from targets through the use of info stealer malware. Search your target here to see if you can make a quick win gaining access to an ~~admin~~ account. Any account that allows internal access is always a great start~~. Invites can be found on forums and markets~~.		You can use the russian market to purchase credentials stolen from targets through the use of info stealer malware. Search your target here to see if you can make a quick win gaining access to an employee account. Any account that allows internal access is always a great start.
	* http://~~genesis7zoveavupiiwnrycmaq6uro3kn5h2be3el7wdnbjti2ln2wid~~.onion~~/guest/login~~ [Paid]		* http://flydedxmmddhgt3vfhv6om63ra2u2x4jxginulhxb6nzcnj3wwgavwyd.onion [Paid]

	You can also find access brokers selling network access inside of companies on forums. Services include but is not limited to account credentials, shells, implants, and other remote management software (RDP, VPN, SSH, etc).		You can also find access brokers selling network access inside of companies on forums. Services include but is not limited to account credentials, shells, implants, and other remote management software (RDP, VPN, SSH, etc).