Offensive Stack

  VOIP Protocols - H.323 - Can Initiate, authenticate, end a request. - Session Initiation Protocol (SIP) - ASCII protocol - reqeuest/response. -  Real-Time Transport Protocol (RTP) - After connecting via VOIP, RTP is used - Secure Real time Transport Protocol (SRTP) #Nmap nmap -O -P0 10.10.10.0/23 #Ports UDP/TCP - 5060 & 5061 #Cisco SCCP Enabled ports UDP/TCP - 2000-2001 #UDP or TCP - VXWORKS remote debugging Port 17185 # cisco-audit-tool CAT -h ip -p 2000 -w /usr/share/wordlists/rockyou.txt # cisco-smart-install https://github.com/Sab0tag3d/SIET/ sudo python siet.py -g -i 192.168.0.1 Enumeration SIP - 'User Agent' & 'Server' SIP phone Extensions (usernames) TFTP Config files SNMP Config Using Netcat nc 10.10.10.10 5060 > OPTIONS sip:test@10.10.10.10 SIP/2.0 SNMP snmpwalk -c public -v 10.10.10.10 1.3.6.1.4.1.6889 SIPVicious Github python3 setup.py install #Scan a set of IP's concurrenrly for ip in $(cat $1); do sipvicious_svmap -p5060-5200 $ip &...

#Find the DNS server nmap --script vuln,vulners --script-args mincvss=7.0 -sC -sV -p 53 --open 10.10.0.0/16 nmap -sU -sV --script "dns* and (discovery or vuln) and not (dos or brute)" -p53 10.10.10.10 #DNS Server Processes Unauthoritative Recursive Queries nmap -Pn -p 53 -sU --script dns-recursion 10.10.10.10 #DNS Server Cache Snooping Remote Information Disclosure nmap -Pn -sU -sV -p 53 --script dns-cache-snoop 10.10.10.10 #DNS Enum via Metasploit auxiliary/gather/enum_dns auxiliary/scanner/dns/dns_amp # DNS Enum nslookup >SERVER 10.10.10.1 # Give the ip address of the server to find its hostname > 10.10.10.10 10.10.10.10.in-addr.arpa name = host02.test.domain. dig axfr host02.test.domain @10.10.10.1 Finding SPF Records -all (Hard Fail) : Strict rejection of emails from unauthorized servers. ~all (Soft Fail) : Flag or mark emails from unauthorized servers as suspicious. +all (Allow All) : Allows emails from any server, effectively disabling SPF checks. ?...

Pivoting for Red Teamers Using rpcclient via Metasploit for Enumeration & Exploitation rpcclient is a powerful tool used for enumerating and interacting with Windows RPC services . It is commonly used in penetration testing to extract usernames, groups, and policies from Windows machines. Using rpcclient Manually (Without Metasploit) If you already have valid credentials (or null session access), you can use rpcclient from Kali Linux: rpcclient -U "" <TARGET_IP> or rpcclient -U "guest" <TARGET_IP> 🔹 If it prompts for a password, just press Enter to attempt a null session login . Common Enumeration Commands enumdomusers # Enumerate domain users queryuser <RID> # Get user details (Replace <RID> with a user RID) enumdomgroups # Enumerate groups querygroup <RID> # Get group details getsid # Get security identifier (SID) lookupnames <...

Pivoting for Red Teamers SMTP Pentesting Notes SMTP (Simple Mail Transfer Protocol) is a key component of email communication. Misconfigured SMTP servers can be vulnerable to attacks such as enumeration, open relay abuse, and authentication bypass. Step 1: Enumerate the SMTP Server Connect to the SMTP server using Telnet: telnet <target-ip> 25 Look for the server banner, which may reveal its version and configuration. Step 2: User Enumeration with VRFY & EXPN Check if the server allows user verification: VRFY admin EXPN postmaster If valid responses are received, the server is disclosing user accounts, which could aid brute-force attacks. Step 3: Open Relay Testing To check if the server allows unauthenticated email forwarding: MAIL FROM:<attacker@example.com> RCPT TO:<victim@example.com> DATA Subject...