CheatSheets

To find vulnerability:

  • https://nvd.nist.gov/vuln
  • http://exploit-db.com/
  • https://www.rapid7.com/db/

For finding a vulnerability, you have different tools, like Nessus, OpenVAS, which scan your environment for finding vulnerabilities.

When you find a vulnerability, you can use a vulnerability database, such Exploit-DB or NVD for exploiting it. Also, on GitHub or GitlLab, you can find some CVE PoC.

The tool SearchSploit is command-line tool for searching a vulnerability which is based on Exploit-DB.

Find SSH version

We can identify the SSH version for identifying if a vulnerability can be exploited:

$ ssh -v <ip>

Or, we telnet:

$ telnet <ip> <port> 
Trying <ip>...
Connected to <ip>.
Escape character is '^]'.
SSH-2.0-OpenSSH_9.2p1 Debian-2+deb12u3

Brute-force

SSH

hydra -l <username> -I -t 4 -P /usr/share/wordlists/SecLists/Passwords/probable-v2-top12000.txt <ip> ssh

IMAP

We can use hydra for brute-forcing the IMAP password. The example below brute-force the user account lazie:

hydra -l lazie -P /usr/share/wordlists/rockyou.txt <ip> imap

Steganography

Extract data

We can extract data from a image:

steghide extract -sf <image filename> -p <password>

Binwalk

Exract data from file:

binwalk -D='.*' image.png