News for hackers. Stuff that matters.
Re:A pentester gets root - step by step example by braingenious on Sunday February 20, 2022 @02:08PM (#30408354)
This is a really interesting topic, but as a newbie I would love a little more detail. For example, with the nmap command, why did they use those particular switches?

>nmap -Pn -sT -p- --min-rate 10000 \ -oN nmap/tcp_ports_scan

I understand that nmap is a very versatile port scanning program, and I haven't used it since I was a kid, but I have no idea what about this particular situation calls for -Pn -sT -p- -oN. Is that an ideal configuration to use when you're scanning a target that you know nothing about?

Re:A pentester gets root - step by step example by phantomread on Sunday February 20, 2022 @02:57PM (#30408776)
I realize documentation is only half the battle but I get a lot from using something like explainshell when I see unknown argument lists: https://explainshell.com/explain?cmd=nmap+-Pn+-sT+-p-+--min-...

This way you can read the full command sort of like a custom pamphlet. To your point, more context beyond the manpage is always helpful.

Re:A pentester gets root - step by step example by braingenious on Sunday February 20, 2022 @03:04PM (#30408836)
What a cool website! Thanks!
Re:A pentester gets root - step by step example by mr_mitm on Monday February 21, 2022 @01:48AM (#30412618)
The answer below mentioning explainshell.com doesn't explain the `-Pn` parameter. This one makes nmap skip host discovery and immediately start the port scan. The developer of nmap discourages using this parameter: https://twitter.com/bonsaiviking/status/1286024550241767426

Only if you know the host is alive and at the same time does not want to be seen, then it may make sense to use it, otherwise it messes with nmap's rate calibration.

The website also doesn't really explain why those switches were chosen.

And it's not clear to me either: unless you lack permissions or you find yourself in some other special circumstances, `-sS` is superior over `-sT` (as the man page explains). The latter creates a full TCP connection, while the former sends only a SYN packet and waits for the response: SYN-ACK means port open, RST means port closed. Then it moves on, leaving the half-opened connection dangling.

`--min-rate` was chosen to increase speed, but it comes at the cost of accuracy. `-T4` is the better switch to increase speed. See the man page for details.

Re:A pentester gets root - step by step example by bombcar on Sunday February 20, 2022 @02:50PM (#30408710)
See the other post above but https://nmap.org/book/scan-methods-udp-scan.html would be a good place to start.