Attacking Common Services (Just Do Formatting)
This section isn't so good, we can remove or add more into it
File Transfer Protocol (FTP)
The File Transfer Protocol (FTP) is a standard network protocol used to transfer files between computers. It also performs directory and files operations, such as changing the working directory, listing files, and renaming and deleting directories or files.
Some of the common attacks on FTP:
Check if the FTP server allows anonymous logins
Bruteforcing the service, if we find a username that we know exist, we can use it to bruteforce the service or we can even perform a password spray attack
FTP bounce attack which is a network attack that uses FTP servers to deliver outbound traffic to another device on the network.
Server Message Block (SMB)
Server Message Block (SMB) is a communication protocol created for providing shared access to files and printers across nodes on a network.
Tools like smbclinet, smbmap, rpcclient, and enum4linux-ng can be used to interact with and test an smb server.
Some of the common attacks on SMB:
Check if the SMB allows anonymous authentication
Try bruteforcing or password spraying attacks
SQL Databases
MySQL and Microsoft SQL Server (MSSQL) are relational database management systems that store data in tables, columns, and rows.
MSSQL supports two authentication modes, Windows authentication and SQL server authentication.
There are some default databases that contain information about the database itself.
MySQL default system schemas/databases:
mysql - is the system database that contains tables that store information required by the MySQL server
information_schema - provides access to database metadata
performance_schema - is a feature for monitoring MySQL Server execution at a low level sys - a set of objects that helps DBAs and developers interpret data collected by the Performance Schema
MSSQL default system schemas/databases:
master - keeps the information for an instance of SQL Server.
msdb - used by SQL Server Agent.
model - a template database copied for each new database.
resource - a read-only database that keeps system objects visible in every database on the server in sys schema.
tempdb - keeps temporary objects for SQL queries.
We can use SQL databases to do more than SQL queries for example, we can write and read files, or we can access other linked databases
Remote Desktop Protocol (RDP)
Remote Desktop Protocol (RDP) is a proprietary protocol developed by Microsoft which provides a user with a graphical interface to connect to another computer over a network connection.
For RDP, we can try password spraying attacks using tools like hydra
On older versions (before Server 2019) we could have hijacked a session.
We can also perform Pass The Hash (PtH) attack
Domain Name System (DNS)
Domain Name System (DNS) translates domain names (e.g., hackthebox.com) to the numerical IP addresses (e.g., 104.17.42.72)
For DNS we can enumrate in general as it would open gates for new attack vectors
We can also attempt a zone transfer attack
DNS spoofing can be used to redirect users to a malicious page crafted by the attacker.
Tools like subrute and subfinder can be used to enumrate subdomains.
Subdomain Takeover is another attack that we can try, if there are records in the DNS that aren't maintained we can takeover these subdomains and then direct the users to a malicious page or even conduct a phishing campaign
Email Services
A mail server (sometimes also referred to as an email server) is a server that handles and delivers email over a network, usually over the Internet.
We can use the Mail eXchanger (MX) DNS record to identify a mail server.
We can use several commnds to enumrate users on an smtp user
After identifying a valid users we can use tools like hydra to run bruteforce attacks or password spray attacks against the valid users.
Last updated