📘
OSCP Exam Prep
OSCP Exam Prep
OSCP Exam Prep
  • Reference List
  • Guideline
  • Commons
    • Basic Scans
    • Service Enumeration
      • HTTP(S) (80 / 443)
      • SMB (139 / 445)
      • FTP (21)
      • DNS (53)
      • SSH (22)
      • LDAP (389/636/3268)
      • Kerberos (88)
      • SNMP (161)
      • SMTP (25)
      • RDP (3389)
      • Evil-WinRM (5985/5986)
      • MYSQL (3306)
      • MSSQL (1433)
    • Default/Common Credentials
    • Shells
      • TTY Shell
    • File Transfer
    • KeePass Database
    • Port Forwarding
    • File Metadata
  • Attacks
    • Run a command x times
    • Public Exploits
    • User Creation
    • Password Cracking
      • Using custom wordlists
    • LFI/RFI
    • SQLi
    • PwnKit
    • SAM and SYSTEM files
    • Phishing for Access (Requires MailSVR)
    • GitDumper
  • Enumeration
    • Linux
    • Windows
  • Privilege Escalation
    • Linux
    • Windows
  • Port Forwarding Extras
    • Linux
    • Windows
  • Active Directory
    • Enumeration
    • Lateral Movement
    • Privilege Escalation
Powered by GitBook
On this page
  • Online Resources
  • SearchSploit
  • ExploitDB
  • WordPress Scan
  1. Attacks

Public Exploits

Online Resources

SearchSploit

searchsploit <keyword>
    Example: Target SMB service on a Windows system
        Input -> searchsploit smb microsoft windows
        Input -> searchsploit -m <EDB-ID>
        
For Kernal Vulnerabilities:
    Linux -
        searchsploit "linux kernel <distro version> Local Privilege Escalation" | grep "<kernel versions>"
        
        <distro version> = cat /etc/issue
        <kernel versions> = uname -r
        
        Example: searchsploit "linux kernel Ubuntu 16 Local Privilege Escalation" | grep "4." | grep -v "< 4.4.0" | grep -v “4.8”
        
    Windows -
        searchsploit "Windows Kernel <Windows version> Local Privilege Escalation"
    
        <Windows version> = systeminfo | findstr /B /C:"OS Name" /C:"OS Version"

ExploitDB

https://www.exploit-db.com/

Google: <Keyword> exploitdb

WordPress Scan

whatweb http://<IP>
wpscan --url http://<IP> --enumerate p --plugins-detection aggressive -o websrv1/wpscan
searchsploit duplicator 1.3.26

PreviousRun a command x timesNextUser Creation

Last updated 3 months ago