🛠 Security Tool Cheatsheet
Alex Morgan — Senior Penetration Tester
What is Hack The Box?
Hack The Box (HTB) is an online platform that allows cybersecurity enthusiasts to practice their penetration testing skills in a legal and safe environment. The platform consists of numerous challenges and vulnerable machines that users can exploit to gain experience in identifying and fixing security vulnerabilities.
Installation
To get started with Hack The Box, follow these steps:
- Create an account on the Hack The Box website.
- Set up a VPN connection to their network. HTB provides a .ovpn file upon account registration.
- Connect to the VPN using your preferred OpenVPN client.
Basic Syntax
Most interactions with Hack The Box will involve using various security tools for scanning and exploitation. Below are some example commands:
nmap -sS -p 22,80,443 {target_ip}
This command initiates a SYN scan on ports 22, 80, and 443 of the specified target IP.
Discovery
Discovery is the first step of any penetration testing engagement. You want to know what services are running and what vulnerabilities may exist.
nmap -sS -p- {target_ip}
This command performs a TCP SYN scan on all ports of the given target IP address, helping you discover open ports.
Scanning
In this phase, you leverage various tools to identify vulnerabilities on the discovered services.
nmap -sV --script=vuln {target_ip}
This command runs service version detection and applies all vulnerability scripts to identify security issues.
Exploitation
Once you identify vulnerabilities, the next step is to exploit them.
msfconsole
Start the Metasploit Framework to find and exploit vulnerabilities.
Analysis
Analyze findings to generate reports and assess impact.
nikto -h {target_ip}
This runs the Nikto web scanner to unveil common vulnerabilities on the web server hosted at the target IP.
Evasion
When attempting to bypass security measures:
curl -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3" {target_url}
This simulates a legitimate browser request while attempting to evade firewall protections.
Reporting
Effective reporting for stakeholders:
a2report {options}
Generate detailed vulnerability assessment reports based on scan results.
Quick Reference Table
| Flag | Description |
|---|---|
| -sS | TCP SYN scan |
| -p | Specifies the ports to scan |
Pro Tips
- Combine Nmap with scripts for thorough testing:
nmap -sV --script http-enum {target_ip} - Always check for version vulnerabilities with services like CVE.
Real-World Examples
In a recent engagement targeting a web application, the following command discovered a vulnerable version of a service:
nmap -sV --script vuln {target_ip}
After exploitation, the found vulnerability was documented as a major risk affecting the organization, demonstrating the utility of HTB scenarios in real-world applications.