This is a basic note for Red Teamers, Pentesters, Offsec Enthusiast, CTF Players etc
For Activity Directory notes check Active Directory.
You can use my script Hackify to install tools and wordlist on your linux system.
nmapAutomator -H $TARGET -t Fullnmap -Pn --min-rate 5000 -T5 -A -oN nmapBasic.txt $TARGETnmap -Pn --min-rate 5000 -T5 -A -p- -oN nmapfulltcp.txt $TARGETnmap -Pn --min-rate 5000 -T5 -A -sU -p- -oN nmapfulludp.txt $TARGETnmap -sC -sS -sU --min-rate 5000 -Pn -p- -T5 -A -oN nmapvuln.txt $TARGETnmap -p 53,88,135,139,389,445,464,593,636,3268,3269,3389,5985,9389,49152-65535 --script smb-enum-shares,smb-enum-users,ldap-rootdse,ldap-search,krb5-enum-users,smb-os-discovery,smb-vuln-ms17-010,smb-enum-domains,smb-enum-sessions,smb-enum-processes,smb2-security-mode,smb2-capabilities,smb-system-info,msrpc-enum,smb-brute,rdp-enum-encryption,rdp-vuln-ms12-020,rdp-ntlm-info,ssl-cert,ssl-enum-ciphers,smb-protocols,ms-sql-info,smb-vuln-regsvc-dos -oN nmapAD.txt $TARGETrustscan -r 1-65535 -a $TARGET -b 10000 -- -sC -sV -A -Pnrustscan --udp -r 1-65535 -a $TARGET -b 10000 -- -sC -sV -A -Pnnaabu -p - -host $TARGETnaabu --nmap-cli "nmap -sC -sV -A -Pn" -p - -rate 10000 -host $TARGETdig axfr @<ip_address> target.tldWordlist generator
cewl http://domain.tld/ | grep -v CeWL > custom-wordlist.txt
ffuf -w /usr/share/seclists/Discovery/DNS/dns-Jhaddix.txt:FUZZ -t 2000 -fw 18 -mc all -ac -u http://domain.tld -H 'Host: FUZZ.domain.tld' , add -fc 400,404 to exclude, add -mc 200 to check match only 200ffuf -w /usr/share/seclists/Discovery/DNS/dns-Jhaddix.txt:FUZZ -t 2000 -fw 18 -mc all -ac -u http://FUZZ.domain.tldsubauto domain.tld [Very useful for real world subdomain enumeration.]BruteForce: ssh, kerbrute or any other service using hydra, medusa or any specific tool like kerbrute etc.
Check outdated or vulnerable version for any service or software using exploitdb and google