diff --git a/linux/bash.md b/2besorted/bash.md similarity index 100% rename from linux/bash.md rename to 2besorted/bash.md diff --git a/cats/ncat.md b/2besorted/cats/ncat.md old mode 100755 new mode 100644 similarity index 100% rename from cats/ncat.md rename to 2besorted/cats/ncat.md diff --git a/cats/netcat.md b/2besorted/cats/netcat.md old mode 100755 new mode 100644 similarity index 100% rename from cats/netcat.md rename to 2besorted/cats/netcat.md diff --git a/cats/socat.md b/2besorted/cats/socat.md old mode 100755 new mode 100644 similarity index 100% rename from cats/socat.md rename to 2besorted/cats/socat.md diff --git a/linux/bulk.md b/2besorted/gdoc_linux.md similarity index 100% rename from linux/bulk.md rename to 2besorted/gdoc_linux.md diff --git a/osx/bulk.md b/2besorted/gdoc_osx.md similarity index 96% rename from osx/bulk.md rename to 2besorted/gdoc_osx.md index 5d45808..1b3d1e2 100644 --- a/osx/bulk.md +++ b/2besorted/gdoc_osx.md @@ -1,68 +1,68 @@ - -# OS X Google Doc Content # - -The content below is the raw data from the Google Doc that was first used to collect it. Over time, this content will be moved into sub-pages and organized but is placed here, now, so as to be more complete. We apologize for its appearance. - ----- - -## Blind Files -(things to pull when all you can do is blindly read) LFI/dir traversal -/etc/resolv.conf (everyone always has read on this and it wont trigger an IDS) - -## System -uname -a -ps aux -ps -aef -id -arch -w -who -a -gcc -v -mysql --version -perl -v -ruby -v -python --version -df -k -mount -last -a -lastlogin (*bsd) -getenforce <- does not work on Lion no idea if this work in previous versions -dmesg -lsusb<- does not work on Lion no idea it this work on previous versions -lshw <- does not work on Lion no idea it this work on previous versions -free -m <- does not work on Lion no idea it this work on previous versions -du -h --max-depth=1 / -which nmap (see if it's already installed) -locate bin/nmap -which nc (see if it's already installed) -locate bin/ -whoami -jps -l -java -version - -## Networking -hostname -f -ip addr show -ifconfig -a -route -n -cat /etc/network/interfaces -iptables -L -n -netstat -anop -netstat -r -netstat -nltupw (root with raw sockets) -arp -a -lsof -nPi - -## Per User -ls -alh /Users/*/ -ls -alh /Users/*/.ssh/ -cat /Users/*/.ssh/authorized_keys -cat /Users/*/.ssh/known_hosts -cat /Users/*/.*hist* -find -type f /Users/*/.vnc /Users/*/.subversion -grep ^ssh /Users/*/.*hist* -grep ^telnet `/Users/*/.*hist* -grep ^mysql /Users/*/.*hist* -cat /Users/*/.viminfo -sudo -l # if sudoers is not readable, this sometimes works per user -crontab -l + +# OS X Google Doc Content # + +The content below is the raw data from the Google Doc that was first used to collect it. Over time, this content will be moved into sub-pages and organized but is placed here, now, so as to be more complete. We apologize for its appearance. + +---- + +## Blind Files +(things to pull when all you can do is blindly read) LFI/dir traversal +/etc/resolv.conf (everyone always has read on this and it wont trigger an IDS) + +## System +uname -a +ps aux +ps -aef +id +arch +w +who -a +gcc -v +mysql --version +perl -v +ruby -v +python --version +df -k +mount +last -a +lastlogin (*bsd) +getenforce <- does not work on Lion no idea if this work in previous versions +dmesg +lsusb<- does not work on Lion no idea it this work on previous versions +lshw <- does not work on Lion no idea it this work on previous versions +free -m <- does not work on Lion no idea it this work on previous versions +du -h --max-depth=1 / +which nmap (see if it's already installed) +locate bin/nmap +which nc (see if it's already installed) +locate bin/ +whoami +jps -l +java -version + +## Networking +hostname -f +ip addr show +ifconfig -a +route -n +cat /etc/network/interfaces +iptables -L -n +netstat -anop +netstat -r +netstat -nltupw (root with raw sockets) +arp -a +lsof -nPi + +## Per User +ls -alh /Users/*/ +ls -alh /Users/*/.ssh/ +cat /Users/*/.ssh/authorized_keys +cat /Users/*/.ssh/known_hosts +cat /Users/*/.*hist* +find -type f /Users/*/.vnc /Users/*/.subversion +grep ^ssh /Users/*/.*hist* +grep ^telnet `/Users/*/.*hist* +grep ^mysql /Users/*/.*hist* +cat /Users/*/.viminfo +sudo -l # if sudoers is not readable, this sometimes works per user +crontab -l diff --git a/linux/cmd_template.md b/_templates/cmd_template.md similarity index 100% rename from linux/cmd_template.md rename to _templates/cmd_template.md diff --git a/linux/persistance.md b/linux/persistance.md deleted file mode 100644 index 1033b81..0000000 --- a/linux/persistance.md +++ /dev/null @@ -1,3 +0,0 @@ -# Place Holder - -Content coming. Feel free to submit ;-) diff --git a/navigation.md b/navigation.md index 8afc5ab..6e2c769 100644 --- a/navigation.md +++ b/navigation.md @@ -2,68 +2,55 @@ [Home](index.md) -[Windows]() +[Presence]() - * [Autostart Locations](windows/autostart.md) - * [Binary Planting](windows/binary.md) - * [CMD Commands](windows/cmd.md) - * [Covering Tracks](windows/cover.md) - * [Files - Blind](windows/blind.md) - * [Files - Finding](windows/find_files.md) - * [Files - Important](windows/files.md) - * [Persistance](windows/persistance.md) - * [Powershell](windows/powershell.md) - * [Privilege Escalation](windows/privesc.md) - * [Remote Access](windows/remote.md) - * [UAC Bypassing](windows/uac.md) - * [MSSQL Servers](windows/mssql.md) + * [Windows](presence/windows/index.md) + * [Linux](presence/linux/index.md) + * [OSX](presence/osx/index.md) - -[Linux]() +[Persistence]() - * [Google Doc Content](linux/bulk.md) - * [Files - Blind](linux/blind.md) - * [Files - Finding](linux/find_files.md) - * [SH/BASH Commands](linux/bash.md) - * [Persistance](linux/persistance.md) - * [Privilege Escalation](linux/privesc.md) + * [Windows](persistence/windows/index.md) + * [Linux](persistence/linux/index.md) + * [OSX](persistence/osx/index.md) +[Pivoting]() -[OSX]() + * [Windows](pivoting/windows/index.md) + * [Linux](pivoting/linux/index.md) + * [OSX](pivoting/osx/index.md) - * [Bash Commands](osx/bash.md) - * [Files - Blind](osx/blind.md) - * [Files - Finding](osx/find_files.md) - * [Persistance](osx/persistance.md) - * [Privilege Escalation](osx/privesc.md) +[Privilege Escalation]() + + * [Windows](privesc/windows/index.md) + * [Linux](privesc/linux/index.md) + * [OSX](privesc/osx/index.md) [Mobile]() * [Android](mobile/android.md) * [iOS](mobile/ios.md) -[Other OSs]() +[Technologies]() - * [zOS](otheros/zos.md) - * [AS/400](otheros/as400.md) - * [Cisco](otheros/cisco.md) - * [Juniper](otheros/juniper.md) + * [Mainframes](tech/mainframes/index.md) + * [Embedded OSs](tech/embedded/index.md) + * [Web Languages](tech/web/languages.md) + * [Web Apps](tech/web/apps.md) + * [Web Servers](tech/web/servers.md) + * [Network Services](tech/services/index.md) + * [Databases](tech/db/index.md) [Scripting]() * [Python](scripting/python.md) + * [Powershell](scripting/powershell.md) * [Ruby](scripting/ruby.md) * [Perl](scripting/perl.md) * [Windows](scripting/windows.md) * [NodeJS](scripting/NodeJS.md) * [Linux bash](scripting/bash.md) -[Cats]() - - * [ncat](cats/ncat.md) - * [netcat](cats/netcat.md) - * [socat](cats/socat.md) - [Metasploit]() * [Meterpreter](msf/meterpreter.md) @@ -77,7 +64,6 @@ * [Unix Rosetta Stone](references/rosetta.htm) - [Links](links.md) [gimmick:themechooser](Wiki Theme) @@ -92,3 +78,4 @@ return false; }); }); + diff --git a/osx/bash.md b/osx/bash.md deleted file mode 100644 index 1033b81..0000000 --- a/osx/bash.md +++ /dev/null @@ -1,3 +0,0 @@ -# Place Holder - -Content coming. Feel free to submit ;-) diff --git a/osx/persistance.md b/osx/persistance.md deleted file mode 100644 index 1033b81..0000000 --- a/osx/persistance.md +++ /dev/null @@ -1,3 +0,0 @@ -# Place Holder - -Content coming. Feel free to submit ;-) diff --git a/osx/privesc.md b/osx/privesc.md deleted file mode 100644 index 1033b81..0000000 --- a/osx/privesc.md +++ /dev/null @@ -1,3 +0,0 @@ -# Place Holder - -Content coming. Feel free to submit ;-) diff --git a/windows/autostart.md b/persistance/windows/autostart.md similarity index 100% rename from windows/autostart.md rename to persistance/windows/autostart.md diff --git a/windows/binary.md b/persistance/windows/binary.md similarity index 100% rename from windows/binary.md rename to persistance/windows/binary.md diff --git a/windows/cover.md b/persistance/windows/cover.md similarity index 100% rename from windows/cover.md rename to persistance/windows/cover.md diff --git a/windows/remote.md b/pivoting/windows/remote.md similarity index 100% rename from windows/remote.md rename to pivoting/windows/remote.md diff --git a/windows/windows_cmd_network.md b/pivoting/windows/windows_cmd_network.md similarity index 100% rename from windows/windows_cmd_network.md rename to pivoting/windows/windows_cmd_network.md diff --git a/linux/blind.md b/presence/linux/blind.md similarity index 100% rename from linux/blind.md rename to presence/linux/blind.md diff --git a/linux/find_files.md b/presence/linux/find_files.md similarity index 100% rename from linux/find_files.md rename to presence/linux/find_files.md diff --git a/presence/linux/index.md b/presence/linux/index.md new file mode 100644 index 0000000..e69de29 diff --git a/linux/pillage.lst b/presence/linux/pillage.lst similarity index 100% rename from linux/pillage.lst rename to presence/linux/pillage.lst diff --git a/osx/blind.md b/presence/osx/blind.md similarity index 100% rename from osx/blind.md rename to presence/osx/blind.md diff --git a/osx/find_files.md b/presence/osx/find_files.md old mode 100755 new mode 100644 similarity index 98% rename from osx/find_files.md rename to presence/osx/find_files.md index 765b0c4..e6f5ed4 --- a/osx/find_files.md +++ b/presence/osx/find_files.md @@ -1,15 +1,15 @@ -# OS X Finding File Commands - -Commands that find files on the filesystem and are usually executed from the context of the shell (`/bin/bash` or `/bin/sh`) prompt. - -| Command | Description / Importance | -| -------- | ------------------------ | -| `find /sbin /usr/sbin /opt /lib` ``echo $PATH` |`'sed s/:/ /g'``` -perm -4000` | Find SUID files. | -| `for user in $(cut -f1 -d: /etc/passwd); do echo $user; crontab -u $user -l; done` | Lists all the user crontab or scheduled tasks files. | -| `find /var/log -type f -exec ls -la {} \;` | Find all the log files in `/var/log/` | -| `ls -alhtr /Volumes` | Display the volumes mounted at `/Volumes` | -| `ls /Users/*/.ssh/*` | Discover SSH files (keys and such) located in each user's home drive. May require root permissions to view these files in other user's directories. | -| `locate tar` | `grep [.]tar$` | Finds all files that have a `.tar` extension. Substitute other archive extensions (e.g., `.zip`, `.7z`, `.rar`) or other extensions such as `.sql` or `.conf`. | -| `locate settings` $#124; `grep [.]php$` | Find all files with the word settings in it and with a `.php` extension. | -| `locate .properties` $#124; `grep [.]properties` | Finds Java configuration files. | - +# OS X Finding File Commands + +Commands that find files on the filesystem and are usually executed from the context of the shell (`/bin/bash` or `/bin/sh`) prompt. + +| Command | Description / Importance | +| -------- | ------------------------ | +| `find /sbin /usr/sbin /opt /lib` ``echo $PATH` |`'sed s/:/ /g'``` -perm -4000` | Find SUID files. | +| `for user in $(cut -f1 -d: /etc/passwd); do echo $user; crontab -u $user -l; done` | Lists all the user crontab or scheduled tasks files. | +| `find /var/log -type f -exec ls -la {} \;` | Find all the log files in `/var/log/` | +| `ls -alhtr /Volumes` | Display the volumes mounted at `/Volumes` | +| `ls /Users/*/.ssh/*` | Discover SSH files (keys and such) located in each user's home drive. May require root permissions to view these files in other user's directories. | +| `locate tar` | `grep [.]tar$` | Finds all files that have a `.tar` extension. Substitute other archive extensions (e.g., `.zip`, `.7z`, `.rar`) or other extensions such as `.sql` or `.conf`. | +| `locate settings` $#124; `grep [.]php$` | Find all files with the word settings in it and with a `.php` extension. | +| `locate .properties` $#124; `grep [.]properties` | Finds Java configuration files. | + diff --git a/windows/blind.md b/presence/windows/blind.md similarity index 100% rename from windows/blind.md rename to presence/windows/blind.md diff --git a/windows/files.md b/presence/windows/files.md similarity index 100% rename from windows/files.md rename to presence/windows/files.md diff --git a/windows/find_files.md b/presence/windows/find_files.md similarity index 100% rename from windows/find_files.md rename to presence/windows/find_files.md diff --git a/windows/cmd.md b/presence/windows/index.md similarity index 100% rename from windows/cmd.md rename to presence/windows/index.md diff --git a/windows/windows_cmd_config.md b/presence/windows/windows_cmd_config.md similarity index 100% rename from windows/windows_cmd_config.md rename to presence/windows/windows_cmd_config.md diff --git a/linux/privesc.md b/privesc/linux/index.md similarity index 100% rename from linux/privesc.md rename to privesc/linux/index.md diff --git a/windows/uac.md b/privesc/windows/uac.md similarity index 100% rename from windows/uac.md rename to privesc/windows/uac.md diff --git a/windows/powershell.md b/scripting/powershell.md similarity index 100% rename from windows/powershell.md rename to scripting/powershell.md diff --git a/windows/mssql.md b/tech/databases/mssql.md similarity index 100% rename from windows/mssql.md rename to tech/databases/mssql.md diff --git a/otheros/cisco.md b/tech/embedded/cisco.md similarity index 100% rename from otheros/cisco.md rename to tech/embedded/cisco.md diff --git a/otheros/juniper.md b/tech/embedded/juniper.md similarity index 100% rename from otheros/juniper.md rename to tech/embedded/juniper.md diff --git a/otheros/as400.md b/tech/mainframes/as400.md similarity index 100% rename from otheros/as400.md rename to tech/mainframes/as400.md diff --git a/otheros/zos.md b/tech/mainframes/zos.md similarity index 100% rename from otheros/zos.md rename to tech/mainframes/zos.md diff --git a/validation/dns.md b/validation/dns.md deleted file mode 100644 index 0fb4a93..0000000 --- a/validation/dns.md +++ /dev/null @@ -1 +0,0 @@ -# DNS Configuration Issues diff --git a/validation/insecure-protocols.md b/validation/insecure-protocols.md deleted file mode 100644 index 8354a50..0000000 --- a/validation/insecure-protocols.md +++ /dev/null @@ -1 +0,0 @@ -# Insecure Protocols diff --git a/validation/linux-unix.md b/validation/linux-unix.md deleted file mode 100644 index 28109b7..0000000 --- a/validation/linux-unix.md +++ /dev/null @@ -1 +0,0 @@ -# Linx/UNIX Configuration Issues diff --git a/validation/smtp.md b/validation/smtp.md deleted file mode 100644 index 48a365e..0000000 --- a/validation/smtp.md +++ /dev/null @@ -1 +0,0 @@ -# SMTP Configuration Issues diff --git a/validation/snmp.md b/validation/snmp.md deleted file mode 100644 index 87c69a9..0000000 --- a/validation/snmp.md +++ /dev/null @@ -1 +0,0 @@ -# SNMP Configuration Issues diff --git a/validation/ssl.md b/validation/ssl.md deleted file mode 100644 index 772e2fc..0000000 --- a/validation/ssl.md +++ /dev/null @@ -1 +0,0 @@ -# SSL/TLS Certificate Issues diff --git a/validation/windows.md b/validation/windows.md deleted file mode 100644 index 3ab659c..0000000 --- a/validation/windows.md +++ /dev/null @@ -1 +0,0 @@ -# Windows Configuration Issues diff --git a/windows/persistance.md b/windows/persistance.md deleted file mode 100644 index 1033b81..0000000 --- a/windows/persistance.md +++ /dev/null @@ -1,3 +0,0 @@ -# Place Holder - -Content coming. Feel free to submit ;-) diff --git a/windows/privesc.md b/windows/privesc.md deleted file mode 100644 index 1033b81..0000000 --- a/windows/privesc.md +++ /dev/null @@ -1,3 +0,0 @@ -# Place Holder - -Content coming. Feel free to submit ;-)