> For the complete documentation index, see [llms.txt](https://mo-ela.gitbook.io/shifrablog/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://mo-ela.gitbook.io/shifrablog/pentesting/ejpt/reconnaissance.md).

# 🔎Reconnaissance

Col. of recon tips/tools from ePTS course + other recourses

## :map: Network Mapping:

### Ping Sweep  (don't show error) [check out Bash tut.](https://tldp.org/HOWTO/Bash-Prog-Intro-HOWTO.html)

```
fping -a -g <net_id>/<mask> 2>/dev/null 
```

### Nmap sweep

Use wildcard (\*) to sweep through a network +  -sn for ping scan:

```
nmap -sn 192.168.0.* -oN discovery.nmap
nmap -sn 10.142.11.0/24
```

use -iL to get a list of IP's from a file:

```
nmap -sn -iL ip_list.txt
```

you can also use other types of host scanning (not just ping scan):

![](https://2411644790-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-McenfzTY6G0gAduakD-%2F-Mffe0QpOQJzlfIVnZUV%2F-Mffv7phV7g9Q9Tc0zSK%2Fimage.png?alt=media\&token=f9b8c7e2-74ae-4b3f-82b6-a9ff99eb6274)

&#x20;&#x20;

## :desktop: OS  Fingerprinting:

### p0f

passively analyze capture traffic (where Nmap props are blocked or you can't actively fingerprint)Nmap. [documentation](https://lcamtuf.coredump.cx/p0f3/)

![](https://2411644790-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-McenfzTY6G0gAduakD-%2F-MffveYjzvIS2Ph5NVlu%2F-MfgATIfwOnzmh0b5FDy%2Fimage.png?alt=media\&token=18d2f014-9a4b-419a-b6c4-6cd22ae29bdd)

### Nmap OS Fingerprinting

use -Pn to skip ping scan (done on the Net Mapping Step)

```
sudo nmap -Pn -sV -O -A -T4 -p- --open -iL <target(s)>
```

![depends on engagement choose lighter/aggressive.](https://2411644790-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-McenfzTY6G0gAduakD-%2F-MfgCFLFqyCbfP2yAqXs%2F-MfgCcct8PJRJlmS96l4%2Fimage.png?alt=media\&token=06d095e2-bd9e-4b99-8834-9ad215d11b08)

`--osscan-limit great when you fastly want to fingerprint thousands of hosts`

`-sV: identify the Deamon running version.`

`-A: Enables OS, Version detection, executes in-build scripts for further snum.`

`-sS: TCP SYN port scan.`

`-sU: UDP port scan.`

`-p-400: scan for the first 400 ports (1-400).`

`-n/-R: no DNS resolve / Always DNS resolve [defualt: sometimes].`

### `Nmap Vul Assessment:`

```
sudo nmap --script vuln --script-args=unsafe=1 -iL <file>
```

## `📂Find Files:`

After exploiting a Windows machine you can find what you want with:

```
dir /s /b <file>
```

## Find User:

assuming you comprised a server (gained a shell) how to find the name of the user managing it:

```
ps aux | grep apache
cat etc/passwd
```

```
find / -iname <flag> 2>/dev/null
```

{% embed url="<https://www.tecmint.com/find-user-account-info-and-login-details-in-linux/>" %}

{% hint style="info" %}
In Linux, **SUID (set owner userId upon execution)** is a special type of file permission given to a file. SUID gives temporary permissions to a user to run the program/file with the permission of the file owner (rather than the user who runs it).
{% endhint %}

![](https://2411644790-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-McenfzTY6G0gAduakD-%2F-MhBl288r1McMk3sGqXj%2F-MhBu5IrL19SAJ4NUsA4%2Fimage.png?alt=media\&token=9fcf7255-550e-4b32-a669-c0c07d9b866d)

Enumerates all the binaries that have SUID permission:

```
find / -perm -u=s -type f 2>/dev/null
```

> -perm -u=s : rhe trick is in this flag by find.

find all writable files:

```
find -type f -maxdepth 1 -writable
```

> example of finding SUID be usful:

> <https://alvinsmith.gitbook.io/progressive-oscp/untitled/vulnversity-privilege-escalation>
>
> full story here: <https://0n3z3r0n3.medium.com/tryhackme-vulnversity-1b1c7d96bca4>

### Finding URLs:

Simple way to extract all JS URLs for potentially secret / sensitive information:

```
cat scope.txt | subjs | tee js_url | uniq | tee js_url 2>/dev/null
```