Automated Scanning Tools These are tools that can be run by attackers or defenders to get a sense for all of the assets in an environment. Create audit user to use for running tools export AUDIT_IAM_USER="usr-security-audit" aws iam create-user --user-name "${AUDIT_IAM_USER}" aws iam attach-user-policy --user-name "${AUDIT_IAM_USER}" --policy-arn arn:aws:iam::aws:policy/ReadOnlyAccess aws iam attach-user-policy --user-name "${AUDIT_IAM_USER}" --policy-arn arn:aws:iam::aws:policy/SecurityAudit aws iam create-access-key --user-name "${AUDIT_IAM_USER}" Be sure to create a profile in your ~/.aws/config and ~/.aws/credentials for this user to make copy and pasting the steps for tools below as easy as possible! ...

I’ve gotten tired of googling the same things over and over again. While loops Run for period of time #!/bin/bash runtime="5 minute" endtime=$(date -ud "$runtime" +%s) while [[ $(date -u +%s) -le $endtime ]] do echo "Time Now: `date +%H:%M:%S`" echo "Sleeping for 10 seconds" sleep 10 done Resource: https://www.golinuxcloud.com/run-while-loop-until-specific-time-shell-bash/ Infinite loop item=true while [ $item = true ]; do echo 'bla'; done While value is an empty string value="" while [[ -z "$value" ]]; do echo "value is empty" # here's where we break out if [[ "$value" ]]; then echo "exiting loop because value has been set to $value" break fi done Read each line of a file while read p; do echo "$p" done <file.txt Resource: https://stackoverflow.com/questions/1521462/looping-through-the-content-of-a-file-in-bash ...

Chef Server Download and Install On Centos 8: CHEF_SERVER_DL=https://packages.chef.io/files/stable/chef-server/14.1.0/el/8/chef-server-core-14.1.0-1.el7.x86_64.rpm INSTALL_DIR=/home/admin wget $CHEF_SERVER_DL -P $INSTALL_DIR Installation: sudo dnf localinstall -y $INSTALL_DIR/chef-server-core-14.1.0-1.el7.x86_64.rpm Configuration Start by setting the following variables to correspond with the commands below: USERNAME="chefadmin" FIRST_NAME="Chef" LAST_NAME="Administrator" EMAIL="chefadmin@myorg.com" KEY_PATH="${HOME}/chefadmin.pem" ORG_NAME="myorg" ORG_FULL_NAME="Organization Inc." VALIDATION_KEY_PATH="/etc/chef/myorg-validator.pem" Install Chef server and automatically accept the license: sudo chef-server-ctl reconfigure --chef-license=accept Show status of server sudo chef-server-ctl status Create new user The key at ${KEY_PATH} will be used by a workstation at a later time. Specifically, it is the private key for the user to auth to the chef server. ...

Create a custom Kali container Begin by cloning into the official repository: git clone https://github.com/offensive-security/kali-linux-docker.git Now let’s modify the Dockerfile to include packages that we want: FROM kalilinux/kali-linux-docker MAINTAINER steev@kali.org RUN echo "deb http://http.kali.org/kali kali-rolling main contrib non-free" > /etc/apt/sources.list && \ echo "deb-src http://http.kali.org/kali kali-rolling main contrib non-free" >> /etc/apt/sources.list ENV DEBIAN_FRONTEND noninteractive RUN apt-get -y update && apt-get -y dist-upgrade && \ apt-get -y install metasploit-framework \ vim \ nfs-common \ cifs-utils \ snmp \ x11-apps \ imagemagick \ && apt-get clean Keep adding packages under imagemagick as you see fit, or remove any that you’re not particularly interested in. ...

Installation Ubuntu install_docker(){ sudo apt-get update sudo apt-get install -y \ ca-certificates \ curl \ gnupg \ lsb-release # Add docker's official GPG key sudo mkdir -p /etc/apt/keyrings curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu $(lsb_release -cs) \ stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null sudo apt-get update sudo apt-get install -y docker-ce docker-ce-cli containerd.io docker-compose-plugin } set_docker_user(){ sudo usermod -aG docker ubuntu } install_docker set_docker_user Resource: https://docs.docker.com/engine/install/ubuntu/ ...

Fix file upload vuln on DVWA docker container By default, the proper permissions are not set to be able to do the file upload vulnerability properly with something like a PHP backdoor. To fix this, pop onto the container: docker exec -it <name of the container> /bin/bash Once you’re on, run this command: chown -R www-data:www-data /app At this point, you should be able to upload a backdoor like Laudanum and go to town like so (once you’ve uploaded the backdoor): ...

Elasticsearch Get version of ES curl http://localhost:9200/ Get all indices in a cluster curl http://localhost:9200/_aliases Get all indices in a cluster (pretty): curl http://localhost:9200/_aliases?pretty=true Show index creation time curl http://localhost:9200/_cat/indices?h=health,status,index,id,pri,rep,docs.count,docs.deleted,store.size,creation.date.string&v= Resource: https://stackoverflow.com/questions/17426521/list-all-indexes-on-elasticsearch-server Get number of docs in a cluster curl http://localhost:9200/_cat/count?v Get number of docs in an index curl http://localhost:9200/index/_count Get Roles This is where you can get answers to questions like “what do I have access to?” curl http://localhost:9200/_security/role Resource: https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-get-role.html ...

IOS List running applications: frida-ps -Ua Run a script on a plugged in phone (and spawn the application): frida -U -l <script>.js --no-pause -f <application>

Thanks, I hate it. Getting Started Install gcloud on MacOS First install the SDK: brew install --cask google-cloud-sdk Once that’s done, you’ll be prompted to make some slight modifications to your ~/.zshrc file: echo '\n# Google Cloud' | tee -a ~/.zshrc echo 'source /usr/local/Caskroom/google-cloud-sdk/latest/google-cloud-sdk/ path.zsh.inc' \ | tee -a ~/.zshrc echo 'source /usr/local/Caskroom/google-cloud-sdk/latest/google-cloud-sdk/ completion.zsh.inc' \ | tee -a ~/.zshrc source ~/.zshrc Install gcloud on Ubuntu echo "deb [signed-by=/usr/share/keyrings/cloud.google.gpg] https://packages.cloud.google.com/apt cloud-sdk main" \ | sudo tee -a /etc/apt/sources.list.d/google-cloud-sdk.list sudo apt-get install -y apt-transport-https ca-certificates gnupg curl https://packages.cloud.google.com/apt/doc/apt-key.gpg \ | sudo apt-key --keyring /usr/share/keyrings/cloud.google.gpg add - sudo apt-get update && sudo apt-get install -y google-cloud-sdk One-liner for an Ubuntu docker container RUN echo \ "deb [signed-by=/usr/share/keyrings/cloud.google.gpg] http://packages.cloud.google.com/apt cloud-sdk main" \ | tee -a /etc/apt/sources.list.d/google-cloud-sdk.list \ && curl https://packages.cloud.google.com/apt/doc/apt-key.gpg \ | apt-key --keyring /usr/share/keyrings/cloud.google.gpg add - \ && apt-get update -y && apt-get install google-cloud-sdk -y Resource: https://cloud.google.com/sdk/docs/install#deb ...

Compile This will compile in debug mode and include symbols gcc -ggdb cprog.c -o cprog Load exec in gdb gdb ./exec Set breakpoint on main b main Show instructions for main function disassemble Show all functions info functions Show all variables This will only work if the program is compiled in debug mode (with symbols) info variables List breakpoints i b Break on a specific memory address b *0x8048417 Show register values i r Show multiple register values i r ebp esp View value for a particular register String value: ...