# Enumeration Quick Start

nmap -sC -sV 10.10.10.10 -oN quick_scan               # Quick Scan                  
nmap -sC -sV -p- -oN all_ports 10.10.10.10            # Full TCP
nmap -sC -sV --script vuln -oN vuln_scan 10.10.10.10  # Quick Vulnscan
sudo nmap -sU -p- -oN udp_scan 10.10.10.10            # Full UDP scan

nc -nv  10.10.10.10 25                                 # Manual Banner Grab 
nc -nvC 10.10.10.10 119                                # interacting with services that expect CRLF

echo "10.10.10.10 foobar.htb" >> /etc/hosts

gobuster dir -u http://10.10.10.10 -w /usr/share/wordlists/dirb/common.txt

gobuster dir -u http://10.10.10.10 -w /usr/share/wordlists/dirb/big.txt -x php,html,txt -k
gobuster dir -u http://10.10.10.10/cgi-bin -w /usr/share/wordlists/dirb/big.txt -x sh,cgi,pl
gobuster dir -u http://10.10.10.10/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt  -t 100 -x .txt,.php,.sql,.php5,.html,.htm,.png,.bak,.tmp

ffuf -w /path/to/wordlist -u https://target/FUZZ
ffuf -w /usr/share/wordlists/dirb/big.txt -u http://10.10.10.10:59777/FUZZ -t 200 -c

ffuf -w /usr/share/wordlists/dirb/big.txt -u http://10.10.10.10:59777/sdcard/FUZZ -t 200 -c -e .txt

ffuf -c -w /usr/share/dnsrecon/subdomains-top1mil-5000.txt -u http://example.com -H "Host: FUZZ.example.com" -fw 5338

sqlmap -u http://10.10.10.10 --crawl=1                # sqlmap crawl  
sqlmap -u http://10.10.10.10 --dbms=mysql --dump      # sqlmap dump database
sqlmap -u http://10.10.10.10 --dbms=mysql --os-shell  # sqlmap shell
# sqlmap with cookie and ssl
sqlmap -u https://10.10.10.10 --cookie="PHPSESSID=ajfda" --level=5 --risk-3 --batch --force-ssl

telnet 10.10.10.10 25             # Telnet to manually run commands

# enumerate usernames with metasploit smtp_enum module
msfconsole -q -x 'setg RHOSTS 10.10.10.10;   
use auxiliary/scanner/smtp/smtp_enum; run;      
use auxiliary/scanner/smtp/smtp_relay; run;     
use auxiliary/scanner/smtp/smtp_version; run;'   

dig  @10.10.10.10 example.local

dig axfr @<DNS_IP> #Try zone transfer without domain
dig axfr @<DNS_IP> <DOMAIN> #Try zone transfer guessing the domain

#fierce will Try to do a zone transfer against every authoritative name server and if this doesn't work, it'll launch a dictionary attack
fierce --domain <DOMAIN> --dns-servers <DNS_IP> 

./kerbrute userenum --dc 10.10.10.10 -d example.local userlist.txt -t 100    #enumerate users using kerbrute

nc -nvC 10.10.10.10 110
(UNKNOWN) [10.10.10.10] 110 (pop3) open
+OK beta POP3 server (JAMES POP3 Server 2.3.2) ready 
USER testuser
+OK
PASS password
+OK Welcome testuser
LIST
+OK 2 1807
1 420
2 6971
.
RETR 1
+OK Message follows

  USER uid           Log in as "uid"
  PASS password      Substitue "password" for your actual password
  STAT               List number of messages, total mailbox size
  LIST               List messages and sizes
  RETR n             Show message n
  DELE n             Mark message n for deletion
  RSET               Undo any changes
  QUIT               Logout (expunges messages if no RSET)
  TOP msg n          Show first n lines of message number msg

sudo apt install nfs-common        # Install dependencies if needed
mkdir /tmp/mount                   # create mount dir in /tmp (will be removed after restart)
/usr/sbin/showmount -e 10.10.10.10 # list shares
sudo mount -t nfs 10.10.10.10:share /tmp/mount/ -nolock

crackmapexec smb 10.10.10.10                    # gives alot if info about smb share
crackmapexec smb 10.10.10.10 -u 'guest' -p ''   # see if guest can mount share 

enum4linux -A 10.10.10.10

smbclient -N -L //10.10.10.10/                   # List shares: -N no auth, -L list available shares
smbclient //10.10.10.10/IT -U username%password  # mount share IT with supplied username and password
smbclient //10.10.10.10/secret -U suit -p 139    # mount secret share as user suit on port 139
smbclient -N //10.10.10.10/backups               # mount backup share anonymously 
mask "";recurse ON;prompt OFF;mget *             # Download an entire share once logged in

smbmap -H 10.10.10.161 -u foo -p bar  

nmap --script smb-vuln* -p 445 10.10.10.10                               # look for vulnerabilities            
nmap -p 445 --script=smb-enum-shares.nse,smb-enum-users.nse 10.10.10.10  # enumerate users

rpcclient -U "" -N 10.10.10.161
rpcclient $>