{"id":13589531,"url":"https://github.com/oncybersec/oscp-enumeration-cheat-sheet","last_synced_at":"2025-04-08T09:33:09.773Z","repository":{"id":159895443,"uuid":"343876667","full_name":"oncybersec/oscp-enumeration-cheat-sheet","owner":"oncybersec","description":"A collection of commands and tools used for conducting enumeration during my OSCP journey","archived":false,"fork":false,"pushed_at":"2021-03-02T18:50:56.000Z","size":20,"stargazers_count":87,"open_issues_count":0,"forks_count":15,"subscribers_count":1,"default_branch":"main","last_synced_at":"2024-08-02T16:31:56.920Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/oncybersec.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2021-03-02T18:42:07.000Z","updated_at":"2024-08-02T07:37:32.000Z","dependencies_parsed_at":null,"dependency_job_id":"2a4a6d30-83a4-4f41-b1a3-af545aca9dee","html_url":"https://github.com/oncybersec/oscp-enumeration-cheat-sheet","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oncybersec%2Foscp-enumeration-cheat-sheet","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oncybersec%2Foscp-enumeration-cheat-sheet/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oncybersec%2Foscp-enumeration-cheat-sheet/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oncybersec%2Foscp-enumeration-cheat-sheet/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/oncybersec","download_url":"https://codeload.github.com/oncybersec/oscp-enumeration-cheat-sheet/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":223314202,"owners_count":17125024,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-01T16:00:31.256Z","updated_at":"2024-11-06T09:31:09.594Z","avatar_url":"https://github.com/oncybersec.png","language":null,"funding_links":[],"categories":["Pentest Methodology"],"sub_categories":["Enumeration"],"readme":"# OSCP Enumeration Cheat Sheet\n\nA collection of commands and tools used for conducting enumeration during my OSCP journey.\n\n## Description\n\nThis is an enumeration cheat sheet that I created while pursuing the OSCP. It also includes the commands that I used on platforms such as Vulnhub and Hack the Box. Some of these commands are based on those executed by the [Autorecon](https://github.com/Tib3rius/AutoRecon) tool.\n\n## Disclaimer\n\nThis cheat sheet should not be considered to be complete and only represents a snapshot in time when I used these commands for performing enumeration during my OSCP journey. These commands should only be used for educational purposes or authorised testing.\n\nTable of Contents\n=================\n\n* [Enumeration](#enumeration)\n  * [Host](#host)\n    * [Nmap](#nmap)\n    * [Proxychains](#proxychains)\n    * [Autorecon](#autorecon)\n  * [Services](#services)\n    * [FTP (21/tcp)](#ftp-21tcp)\n    * [SSH (22/tcp)](#ssh-22tcp)\n    * [SMTP (25/tcp)](#smtp-25tcp)\n    * [DNS (53/tcp, 53/udp)](#dns-53tcp-53udp)\n    * [HTTP/HTTPS (80/tcp, 443/tcp)](#httphttps-80tcp-443tcp)\n    * [Kerberos (88/tcp, 464/tcp)](#kerberos-88tcp-464tcp)\n    * [POP3/POP3S (110/tcp, 995/tcp)](#pop3pop3s-110tcp-995tcp)\n    * [RPC (111/tcp, 135/tcp)](#rpc-111tcp-135tcp)\n    * [ident (113/tcp)](#ident-113tcp)\n    * [NTP (123/udp)](#ntp-123udp)\n    * [NetBIOS-NS (137/udp)](#netbios-ns-137udp)\n    * [SMB (139/tcp, 445/tcp)](#smb-139tcp-445tcp)\n    * [IMAP/IMAPS (143/tcp, 993/tcp)](#imapimaps-143tcp-993tcp)\n    * [SNMP (161/udp)](#snmp-161udp)\n    * [LDAP (389/tcp, 3268/tcp)](#ldap-389tcp-3268tcp)\n    * [Java RMI (1100/tcp)](#java-rmi-1100tcp)\n    * [MSSQL (1433/tcp)](#mssql-1433tcp)\n    * [Oracle TNS listener (1521/tcp)](#oracle-tns-listener-1521tcp)\n    * [NFS (2049/tcp)](#nfs-2049tcp)\n    * [MySQL (3306/tcp)](#mysql-3306tcp)\n    * [RDP (3389/tcp)](#rdp-3389tcp)\n    * [SIP (5060/udp)](#sip-5060udp)\n    * [PostgreSQL (5432/tcp)](#postgresql-5432tcp)\n    * [VNC (5900/tcp)](#vnc-5900tcp)\n    * [AJP (8009/tcp)](#ajp-8009tcp)\n  * [Active Directory](#active-directory)\n\n# Enumeration\n\n## Host\n\n### Nmap\n\n```text\n# Full TCP port scan\nsudo nmap -Pn -p- -oN alltcp_ports.txt $ip\n\n# Full TCP port scan (safe scripts + version detection)\nsudo nmap -Pn -sC -sV -p- -oN alltcp.txt $ip\n\n# Top 20 UDP port scan\nsudo nmap -Pn -sU -sV -sC --top-ports=20 -oN top_20_udp_nmap.txt $ip\n```\n\n### Proxychains\n\n```text\n# Top 20 TCP port scan\nproxychains nmap -Pn -sT --top-ports=20 --open -oN top_20_tcp_nmap.txt $ip\n\n# Top 1000 TCP port scan\nproxychains nmap -Pn -sT --top-ports=1000 --open -oN top_1000_tcp_nmap.txt $ip\n\n# Scan TCP ports (safe scripts + version detection)\nproxychains nmap -Pn -sT -sC -sV -p 21,22,80 -oN tcp_nmap_sC_sV.txt $ip\n```\n\n### Autorecon\n\n```text\n# Scan single target\nsudo autorecon -o enumeration $ip\n\n# Scan multiple targets\nsudo autorecon -o enumeration $ip1 $ip2 $ip3 $ip4\n```\n\n## Services\n\n### FTP (21/tcp)\n\n```text\n# Version detection + NSE scripts\nnmap -Pn -sV -p 21 --script=\"banner,(ftp* or ssl*) and not (brute or broadcast or dos or external or fuzzer)\" -oN \"tcp_21_ftp_nmap.txt\" $ip\n```\n\n### SSH (22/tcp)\n\n```text\n# Version detection + NSE scripts\nnmap -Pn -sV -p 22 --script=banner,ssh2-enum-algos,ssh-hostkey,ssh-auth-methods -oN tcp_22_ssh_nmap.txt $ip\n```\n\n### SMTP (25/tcp)\n\n```text\n# Version detection + NSE scripts\nnmap -Pn -sV -p 25 \"--script=banner,(smtp* or ssl*) and not (brute or broadcast or dos or external or fuzzer)\" -oN tcp_25_smtp_nmap.txt $ip\n```\n\n[smtp-user-enum](https://pypi.org/project/smtp-user-enum)\n\n```text\n/home/kali/.local/bin/smtp-user-enum -V -m RCPT -w -f '\u003cuser@example.com\u003e' -d 'domain.local' -U \"/usr/share/metasploit-framework/data/wordlists/unix_users.txt\" $ip 25 2\u003e\u00261 | tee \"tcp_25_smtp_user-enum.txt\"\n```\n\n### DNS (53/tcp, 53/udp)\n\n```text\n# Version detection + NSE scripts\nsudo nmap -Pn -sU -sV -p 53 \"--script=banner,(dns* or ssl*) and not (brute or broadcast or dos or external or fuzzer)\" -oN udp_53_dns_nmap.txt $ip\n```\n\n```text\n# Perform zone transfer (only works over port 53/tcp)\ndig axfr @$ip $domain 2\u003e\u00261 | tee \"tcp_53_dns_dig.txt\"\n\n# Perform reverse DNS lookup (may display NS record containing domain name)\nnslookup $ip $ip\n\n# Brute force subdomains\ngobuster dns -d $domain -w /usr/share/seclists/Discovery/DNS/bitquark-subdomains-top100000.txt -t 16 -o \"tcp_53_dns_gobuster.txt\"\n```\n\n### HTTP/HTTPS (80/tcp, 443/tcp)\n\n```text\n# Version detection + NSE scripts\nnmap -Pn -sV -p $port \"--script=banner,(http* or ssl*) and not (brute or broadcast or dos or external or http-slowloris* or fuzzer)\" -oN tcp_port_protocol_nmap.txt $ip\n```\n\n**Nikto**\n\n```text\nnikto -h $url 2\u003e\u00261 | tee \"tcp_port_protocol_nikto.txt\"\n```\n\n**Directory brute force**\n\n```text\ngobuster dir -u $url -w /usr/share/seclists/Discovery/Web-Content/common.txt -x \"txt,html,php,asp,aspx,jsp\" -s \"200,204,301,302,307,403,500\" -k -t 16 -o \"tcp_port_protocol_gobuster.txt\"  \n\npython3 /opt/dirsearch/dirsearch.py -u $url -t 16 -e txt,html,php,asp,aspx,jsp -f -x 403 -w /usr/share/seclists/Discovery/Web-Content/common.txt --plain-text-report=\"tcp_port_protocol_dirsearch.txt\"\n\nDirbuster (GUI): only perform extension brute force - disable 'Brute Force Dirs'\n\nwfuzz -c -z file,/usr/share/seclists/Discovery/Web-Content/common.txt --hc 404 -t 16 $url/FUZZ 2\u003e\u00261 | tee \"tcp_port_http_wfuzz.txt\"\n\n# Directory brute force recursively with max depth = 2\npython3 /opt/dirsearch/dirsearch.py -u $url/apps/ -t 16 -e txt,html,php -f -x 403 -r -R 2 -w /usr/share/seclists/Discovery/Web-Content/common.txt --plain-text-report=\"tcp_port_protocol_dirsearch_apps.txt\"\n```\n\n**Whatweb**\n\n```text\nwhatweb --color=never --no-errors -a 3 -v $url 2\u003e\u00261 | tee \"tcp_port_protocol_whatweb.txt\"\n```\n\n**Wordpress**\n\n```text\n# Enumerate vulnerable plugins and themes, timthumbs, wp-config.php backups, database exports, usernames and media IDs\nwpscan --url $url --no-update --disable-tls-checks -e vp,vt,tt,cb,dbe,u,m --plugins-detection aggressive --plugins-version-detection aggressive -f cli-no-color 2\u003e\u00261 | tee tcp_port_protocol_wpscan.txt\n\n# Enumerate all plugins\nwpscan --url $url --disable-tls-checks --no-update -e ap --plugins-detection aggressive -f cli-no-color 2\u003e\u00261 | tee tcp_port_protocol_wpscan_plugins.txt\n```\n\n**Robots.txt**\n\n```text\n/robots.txt\n```\n\n**Only get HTTP headers**\n\n```text\ncurl -I $url\n```\n\n**Cewl**\n\n```text\ncewl $url/index.php -m 3 --with-numbers -w cewl.txt\n```\n\n**Drupal**\n\n```text\npython3 drupwn --version 7.28 --mode enum --target $url\n\ndroopescan scan drupal -u $url\n```\n\n**Shellshock**\n\n```text\n# Check if bash vulnerable to CVE-2014-6271 (bash vulnerable if ‘vulnerable’ in output)\nenv x='() { :;}; echo vulnerable' bash -c \"echo this is a test\" \n\n# Brute force CGI files\ngobuster dir -u $url/cgi-bin/ -w /usr/share/seclists/Discovery/Web-Content/common.txt -x \"cgi,sh,pl,py\" -s \"200,204,301,302,307,403,500\" -t 16 -o \"tcp_port_protocol_gobuster_shellshock.txt\"\n\nwfuzz -c -z file,/usr/share/seclists/Discovery/Web-Content/CGIs.txt --hc 404 -t 16 $url/cgi-bin/FUZZ 2\u003e\u00261 | tee \"tcp_port_protocol_wfuzz.txt\"\n\nWebmin uses cgi files - versions up to 1.700 vulnerable to shellshock (http://www.webmin.com/security.html)\n```\n\n### Kerberos (88/tcp, 464/tcp)\n\n```text\n# Version detection + NSE scripts\nnmap -Pn -sV -p $port --script=\"banner,krb5-enum-users\" -oN \"tcp_port_kerberos_nmap.txt\" $ip\n```\n\n### POP3/POP3S (110/tcp, 995/tcp)\n\n```text\n# Version detection + NSE scripts\nnmap -Pn -sV -p $port \"--script=banner,(pop3* or ssl*) and not (brute or broadcast or dos or external or fuzzer)\" -oN tcp_port_pop3_nmap.txt $ip\n```\n\n### RPC (111/tcp, 135/tcp)\n\n**msrpc/rpcbind**\n\n```text\n# Version detection + NSE scripts\nnmap -Pn -sV -p $port --script=banner,msrpc-enum,rpc-grind,rpcinfo -oN tcp_port_rpc_nmap.txt $ip  \n```\n\n**rpcinfo**\n\n```text\n# List all registered RPC programs\nrpcinfo -p $ip\n\n# Provide compact results\nrpcinfo -s $ip\n```\n\n**Null session**\n\n```text\nrpcclient -U \"\" -N $ip\n    srvinfo\n    enumdomusers\n    getdompwinfo\n    querydominfo\n    netshareenum\n    netshareenumall\n```\n\n### ident (113/tcp)\n\n**Enumerate users services running as**\n\n```text\nident-user-enum $ip 22 25 80 445\n```\n\n### NTP (123/udp)\n\n```text\n# Run ntp-info NSE script\nsudo nmap -sU -p 123 --script ntp-info $ip\n```\n\n### NetBIOS-NS (137/udp)\n\n**enum4linux**\n\n```text\nenum4linux -a -M -l -d $ip 2\u003e\u00261 | tee \"enum4linux.txt\"\n```\n\n**nbtscan**\n\n```text\nnbtscan -rvh $ip 2\u003e\u00261 | tee \"nbtscan.txt\"\n```\n\n### SMB (139/tcp, 445/tcp)\n\n```text\n# Version detection + NSE scripts\nnmap -Pn -sV -p 445 \"--script=banner,(nbstat or smb* or ssl*) and not (brute or broadcast or dos or external or fuzzer)\" --script-args=unsafe=1 -oN tcp_445_smb_nmap.txt $ip\n```\n\n**smbmap**\n\n```text\n# List share permissions\nsmbmap -H $ip -P 445 2\u003e\u00261 | tee -a \"smbmap-share-permissions.txt\"; smbmap -u null -p \"\" -H $ip -P 445 2\u003e\u00261 | tee -a \"smbmap-share-permissions.txt\"\n\n# List share contents\nsmbmap -H $ip -P 445 -R 2\u003e\u00261 | tee -a \"smbmap-list-contents.txt\"; smbmap -u null -p \"\" -H $ip -P 445 -R 2\u003e\u00261 | tee -a \"smbmap-list-contents.txt\"\n```\n\n**enum4linux**\n\n```text\nenum4linux -a -M -l -d $ip 2\u003e\u00261 | tee \"enum4linux.txt\"\n```\n\n**Enumerate Samba version (\\*nix)**\n\n```text\n# NB: change interface tcpdump listening on\nsudo ./smbver.sh $ip 139\n```\n\n**Null session**\n\n```text\nsmbmap -H $ip\nsmbclient -L //$ip/ -U '' -N\n```\n\n**Enumerate shares**\n\n```text\nnmap --script smb-enum-shares -p 445 $ip\n```\n\n**Connect to wwwroot share (try blank password)**\n\n```text\nsmbclient \\\\\\\\$ip\\\\wwwroot\n```\n\n**Nmap scans for SMB vulnerabilities (NB: can cause DoS)**\n\n```text\n# RRAS Service Overflow\n# https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-025\nnmap -Pn -sV -p 445 --script=\"smb-vuln-ms06-025\" --script-args=\"unsafe=1\" -oN \"tcp_445_smb_ms06-025.txt\" $ip\n\n# DNS RPC Service Overflow\n# https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-029\nnmap -Pn -sV -p 445 --script=\"smb-vuln-ms07-029\" --script-args=\"unsafe=1\" -oN \"tcp_445_smb_ms07-029.txt\" $ip\n\n# Server Service Vulnerability\n# https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-067\nnmap -Pn -sV -p 445 --script=\"smb-vuln-ms08-067\" --script-args=\"unsafe=1\" -oN \"tcp_445_smb_ms08-067.txt\" $ip\n\n# Eternalblue\n# https://docs.microsoft.com/en-us/security-updates/securitybulletins/2017/ms17-010    \nnmap -p 445 --script smb-vuln-ms17-010 -oN \"tcp_445_smb_ms08-067.txt\" $ip\n```\n\n### IMAP/IMAPS (143/tcp, 993/tcp)\n\n```text\n# Version detection + NSE scripts\nnmap -Pn -sV -p $port \"--script=banner,(imap* or ssl*) and not (brute or broadcast or dos or external or fuzzer)\" -oN tcp_port_imap_nmap.txt $ip  \n```\n\n### SNMP (161/udp)\n\n```text\n# Version detection + NSE scripts\nsudo nmap -Pn -sU -sV -p 161 --script=\"banner,(snmp* or ssl*) and not (brute or broadcast or dos or external or fuzzer)\" -oN \"udp_161_snmp-nmap.txt\" $ip       \n```\n\n**Brute force community strings**\n\n```text\nonesixtyone -c /usr/share/seclists/Discovery/SNMP/common-snmp-community-strings-onesixtyone.txt $ip 2\u003e\u00261 | tee \"udp_161_snmp_onesixtyone.txt\"      \n```\n\n**snmpwalk**\n\n```text\n# Enumerate entire MIB tree\nsnmpwalk -c public -v1 -t 10 $ip\n\n# Enumerate Windows users\nsnmpwalk -c public -v1 $ip 1.3.6.1.4.1.77.1.2.25\n\n# Enumerate running Windows processes\nsnmpwalk -c public -v1 $ip 1.3.6.1.2.1.25.4.2.1.2\n\n# Enumerate open TCP ports\nsnmpwalk -c public -v1 $ip 1.3.6.1.2.1.6.13.1.3\n\n# Enumerate installed software\nsnmpwalk -c public -v1 $ip 1.3.6.1.2.1.25.6.3.1.2\n```\n\n**Enumerate SNMP device (places info in readable format)**\n\n```text\nsnmp-check $ip -c public\n```\n\n### LDAP (389/tcp, 3268/tcp)\n\n```text\n# Version detection + NSE scripts\nnmap -Pn -sV -p $port --script=\"banner,(ldap* or ssl*) and not (brute or broadcast or dos or external or fuzzer)\" -oN \"tcp_port_ldap_nmap.txt\" $ip\n```\n\n**enum4linux**\n\n```text\nenum4linux -a -M -l -d $ip 2\u003e\u00261 | tee \"enum4linux.txt\"\n```\n\n### Java RMI (1100/tcp)\n\n```text\n# Version detection + NSE scripts\nnmap -Pn -sV -p 1100 --script=\"banner,rmi-vuln-classloader,rmi-dumpregistry\" -oN \"tcp_110_rmi_nmap.txt\" $ip\n```\n\n### MSSQL (1433/tcp)\n\n```text\n# Version detection + NSE scripts\nnmap -Pn -sV -p 1433 --script=\"banner,(ms-sql* or ssl*) and not (brute or broadcast or dos or external or fuzzer)\" --script-args=\"mssql.instance-port=1433,mssql.username=sa,mssql.password=sa\" -oN \"tcp_1433_mssql_nmap.txt\" $ip\n```\n\n**mssqlclient\u0026#46;py**\n\n```text\n# MSSQL shell\nmssqlclient.py -db msdb hostname/sa:password@$ip\n\n# List databases\nSELECT name FROM master.dbo.sysdatabases\n\n# List tables\nSELECT * FROM \u003cdatabase_name\u003e.INFORMATION_SCHEMA.TABLES\n\n# List users and password hashes\nSELECT sp.name AS login, sp.type_desc AS login_type, sl.password_hash, sp.create_date, sp.modify_date, CASE WHEN sp.is_disabled = 1 THEN 'Disabled' ELSE 'Enabled' END AS status FROM sys.server_principals sp LEFT JOIN sys.sql_logins sl ON sp.principal_id = sl.principal_id WHERE sp.type NOT IN ('G', 'R') ORDER BY sp.name   \n```\n\n### Oracle TNS listener (1521/tcp)\n\n**tnscmd10g**\n\n```text\ntnscmd10g version -h $ip\ntnscmd10g status -h $ip\n```\n\n### NFS (2049/tcp)\n\n```text\n# Version detection + NSE scripts\nnmap -Pn -sV -p 111,2049 --script=\"banner,(rpcinfo or nfs*) and not (brute or broadcast or dos or external or fuzzer)\" -oN \"tcp_111_2049_nfs_nmap.txt\" $ip\n```\n\n**Show mount information**\n\n```text\nshowmount -e $ip\n```\n\n**Mount share**\n\n```text\nsudo mount -o rw,vers=2 $ip:/home /mnt\n\n# '-o nolock' used to disable file locking, needed for older NFS servers\nsudo mount -o nolock $ip:/home /mnt/\n```\n\n### MySQL (3306/tcp)\n\n```text\n# Version detection + NSE scripts\nnmap -Pn -sV -p 3306 --script=\"banner,(mysql* or ssl*) and not (brute or broadcast or dos or external or fuzzer)\" -oN \"tcp_3306_mysql_nmap.txt\" $ip\n```\n\n**MySQL shell**\n\n```text\nmysql --host=$ip -u root -p\n```\n\n**MySQL system variables**\n\n```text\nSHOW VARIABLES;     \n```\n\n**Show privileges granted to current user**\n\n```text\nSHOW GRANTS;\n```\n\n**Show privileges granted to root user**\n\n```text\n# Replace 'password' field with 'authentication_string' if it does not exist\nSELECT user,password,create_priv,insert_priv,update_priv,alter_priv,delete_priv,drop_priv FROM mysql.user WHERE user = 'root';\n```\n\n**Exact privileges**\n\n```text\nSELECT grantee, table_schema, privilege_type FROM information_schema.schema_privileges;     \n```\n\n**Enumerate file privileges (see [here](https://dev.mysql.com/doc/refman/8.0/en/privileges-provided.html#priv_file) for discussion of file_priv)**\n\n```text\nSELECT user FROM mysql.user WHERE file_priv='Y';\n```\n\n### RDP (3389/tcp)\n\n```text\n# Version detection + NSE scripts\nnmap -Pn -sV -p 3389 --script=\"banner,(rdp* or ssl*) and not (brute or broadcast or dos or external or fuzzer)\" -oN \"tcp_3389_rdp_nmap.txt\" $ip\n```\n\n### SIP (5060/udp)\n\n**Scans for SIP devices on network**\n\n```text\nsvmap $ip\n```\n\n**Identifies active extensions on PBX**\n\n```text\nsvwar -m INVITE -e 200-250 $ip\n```\n\n### PostgreSQL (5432/tcp)\n\n**Log into postgres remotely**\n\n```text\nPGPASSWORD=postgres psql -h $ip -p 5437 -U postgres\n```\n\n**List databases**\n\n```text\n\\list\nSELECT datname FROM pg_database;\n```\n\n**Use postgres database**\n\n```text\n\\c postgres\n```\n\n**List tables**\n\n```text\n\\d\n```\n\n**Describe table**\n\n```text\n\\d table\n```\n\n**Check if current user superuser (on = yes, off = no)**\n\n```text\nSELECT current_setting ('is_superuser');\n```\n\n**Get user roles**\n\n```text\n\\du+\n```\n\n**Check user’s privileges over table (pg_shadow)**\n\n```text\nSELECT grantee, privilege_type FROM information_schema.role_table_grants WHERE table_name='pg_shadow';\n```\n\n**Read file (/etc/passwd)**\n\n```text\nCREATE TABLE demo(t text);\nCOPY demo FROM '/etc/passwd';\nSELECT * FROM demo;\n```\n\n**Read usernames and password hashes**\n\n```text\n# Postgresql password hash format: md5(secret || username) where || denotes string concatenation (remove md5 before cracking hash)\nSELECT usename, passwd from pg_shadow;\n```\n\n**Check if plpgsql enabled**\n\n```text\n# Below result indicates that plpgsql enabled:\n# lanname | lanacl\n#---------+---------\n# plpgsql |            \nSELECT lanname,lanacl FROM pg_language WHERE lanname = 'plpgsql'\n```\n\n**PostgreSQL config file location**\n\n```text\nSHOW config_file;\n```\n\n### VNC (5900/tcp)\n\n```text\n# Version detection + NSE scripts\nnmap -Pn -sV -p 5900 --script=\"banner,(vnc* or realvnc* or ssl*) and not (brute or broadcast or dos or external or fuzzer)\" --script-args=\"unsafe=1\" -oN \"tcp_5900_vnc_nmap.txt\" $ip\n```\n\n### AJP (8009/tcp)\n\n```text\n# Version detection + NSE scripts\nnmap -Pn -sV -p 8009 -n --script ajp-auth,ajp-headers,ajp-methods,ajp-request -oN tcp_8009_ajp_nmap.txt $ip\n```\n\n## Active Directory\n\n**Enumerate users**\n\n```text\nnet user\nnet user /domain\nnet user $domain_user /domain\n```\n\n**Enumerate groups**\n\n```text\nnet group /domain\n\n# Includes domain users that are part of local administrators group\nnet localgroup administrators\n```\n\n**PowerView**\n\n```text\n# Import PowerView\nPS\u003e Import-Module .\\PowerView.ps1\n\n# Get info about current domain\nPS\u003e Get-NetDomain\n\n# List members of Domain Admins group\nPS\u003e Get-NetGroupMember -GroupName \"Domain Admins\"\n\n# List all computers in domain\nPS\u003e Get-NetComputer\n\n# Enumerate logged-on users\n# NB: only lists users logged on to target if we have local administrator privileges on target\nPS\u003e Get-NetLoggedon -ComputerName $hostname\n\n# Enumerate active user sessions on servers e.g. file servers or domain controllers\nPS\u003e Get-NetSession -ComputerName $hostname\n\n# Enumerate SPNs\nPS\u003e Get-NetUser -SPN | select serviceprincipalname\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Foncybersec%2Foscp-enumeration-cheat-sheet","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Foncybersec%2Foscp-enumeration-cheat-sheet","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Foncybersec%2Foscp-enumeration-cheat-sheet/lists"}