mirror of
https://github.com/carlospolop/hacktricks
synced 2025-02-16 22:18:27 +00:00
173 lines
11 KiB
Markdown
173 lines
11 KiB
Markdown
# Pentesting Methodology
|
|
|
|
{% hint style="success" %}
|
|
Jifunze na fanya mazoezi ya AWS Hacking:<img src="../.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="../.gitbook/assets/arte.png" alt="" data-size="line">\
|
|
Jifunze na fanya mazoezi ya GCP Hacking: <img src="../.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="../.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
|
|
|
<details>
|
|
|
|
<summary>Support HackTricks</summary>
|
|
|
|
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
|
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuatilie** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
|
* **Shiriki mbinu za hacking kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
|
|
|
</details>
|
|
{% endhint %}
|
|
|
|
<figure><img src="../.gitbook/assets/image (1) (1) (1) (1) (1) (1) (1) (1) (1) (1).png" alt=""><figcaption></figcaption></figure>
|
|
|
|
Ikiwa unavutiwa na **kazi ya hacking** na kuweza kuvunja yasiyoweza kuvunjwa - **tunatafuta wafanyakazi!** (_kuandika na kuzungumza kwa Kiswahili vizuri kunahitajika_).
|
|
|
|
{% embed url="https://www.stmcyber.com/careers" %}
|
|
|
|
## Pentesting Methodology
|
|
|
|
<figure><img src="../.gitbook/assets/HACKTRICKS-logo.svg" alt=""><figcaption></figcaption></figure>
|
|
|
|
_Logo za Hacktricks zimeundwa na_ [_@ppiernacho_](https://www.instagram.com/ppieranacho/)_._
|
|
|
|
### 0- Mashambulizi ya Kimwili
|
|
|
|
Je, una **ufikiaji wa kimwili** kwa mashine unayotaka kushambulia? Unapaswa kusoma baadhi ya [**mbinu kuhusu mashambulizi ya kimwili**](../hardware-physical-access/physical-attacks.md) na nyingine kuhusu [**kutoroka kutoka kwa programu za GUI**](../hardware-physical-access/escaping-from-gui-applications.md).
|
|
|
|
### 1 - [Kugundua mwenyeji ndani ya mtandao](pentesting-network/#discovering-hosts)/ [Kugundua Mali za kampuni](external-recon-methodology/)
|
|
|
|
**Inategemea** ikiwa **mtihani** unaofanya ni **mtihani wa ndani au wa nje** unaweza kuwa na hamu ya kutafuta **wenyeji ndani ya mtandao wa kampuni** (mtihani wa ndani) au **kutafuta mali za kampuni kwenye mtandao** (mtihani wa nje).
|
|
|
|
{% hint style="info" %}
|
|
Kumbuka kwamba ikiwa unafanya mtihani wa nje, mara tu unavyoweza kupata ufikiaji wa mtandao wa ndani wa kampuni unapaswa kuanzisha tena mwongo huu.
|
|
{% endhint %}
|
|
|
|
### **2-** [**Kufurahia mtandao**](pentesting-network/) **(Ndani)**
|
|
|
|
**Sehemu hii inatumika tu ikiwa unafanya mtihani wa ndani.**\
|
|
Kabla ya kushambulia mwenyeji huenda ukapendelea **kuiba baadhi ya akidi** **kutoka kwenye mtandao** au **kunusa** baadhi ya **data** ili kujifunza **kwa pasivu/aktively(MitM)** unachoweza kupata ndani ya mtandao. Unaweza kusoma [**Pentesting Network**](pentesting-network/#sniffing).
|
|
|
|
### 3- [Skana Bandari - Kugundua huduma](pentesting-network/#scanning-hosts)
|
|
|
|
Jambo la kwanza kufanya unapokuwa **ukitafuta udhaifu katika mwenyeji** ni kujua ni **huduma zipi zinaendesha** katika bandari zipi. Hebu tuone [**zana za msingi za kuskan bandari za wenyeji**](pentesting-network/#scanning-hosts).
|
|
|
|
### **4-** [**Kutafuta matukio ya huduma**](search-exploits.md)
|
|
|
|
Mara tu unavyojua ni huduma zipi zinaendesha, na labda toleo lao, unapaswa **kutafuta udhaifu uliojulikana**. Huenda ukapata bahati na kuna exploit ya kukupa shell...
|
|
|
|
### **5-** Huduma za Pentesting
|
|
|
|
Ikiwa hakuna exploit ya kuvutia kwa huduma yoyote inayofanya kazi, unapaswa kutafuta **makosa ya kawaida katika kila huduma inayofanya kazi.**
|
|
|
|
**Ndani ya kitabu hiki utapata mwongozo wa pentest huduma za kawaida zaidi** (na nyingine ambazo si za kawaida sana)**. Tafadhali, tafuta kwenye orodha ya kushoto sehemu ya** _**PENTESTING**_ **(huduma zimepangwa kwa bandari zao za kawaida).**
|
|
|
|
**Ninataka kutoa kumbukumbu maalum kwa** [**Pentesting Web**](../network-services-pentesting/pentesting-web/) **sehemu (kama ni kubwa zaidi).**\
|
|
Pia, mwongozo mdogo juu ya jinsi ya [**kutafuta udhaifu uliojulikana katika programu**](search-exploits.md) unaweza kupatikana hapa.
|
|
|
|
**Ikiwa huduma yako haipo kwenye orodha, tafuta kwenye Google** kwa mafunzo mengine na **niambie ikiwa unataka niiongeze.** Ikiwa **huwezi kupata chochote** kwenye Google, fanya **pentesting yako ya kipofu**, unaweza kuanza kwa **kuungana na huduma, kuifanyia fuzzing na kusoma majibu** (ikiwa yapo).
|
|
|
|
#### 5.1 Zana za Kiotomatiki
|
|
|
|
Pia kuna zana kadhaa ambazo zinaweza kufanya **tathmini za udhaifu za kiotomatiki**. **Ningependekeza ujaribu** [**Legion**](https://github.com/carlospolop/legion)**, ambayo ni zana niliyounda na inategemea maelezo kuhusu huduma za pentesting ambazo unaweza kupata katika kitabu hiki.**
|
|
|
|
#### **5.2 Kuangamiza huduma**
|
|
|
|
Katika hali fulani **Brute-Force** inaweza kuwa na manufaa ili **kuathiri** **huduma**. [**Pata hapa CheatSheet ya huduma tofauti za kuangamiza**](brute-force.md)**.**
|
|
|
|
### 6- [Phishing](phishing-methodology/)
|
|
|
|
Ikiwa katika hatua hii huja pata udhaifu wowote wa kuvutia unapaswa **kujaribu baadhi ya phishing** ili kuingia ndani ya mtandao. Unaweza kusoma mbinu zangu za phishing [hapa](phishing-methodology/):
|
|
|
|
### **7-** [**Kupata Shell**](reverse-shells/)
|
|
|
|
Kwa namna fulani unapaswa kuwa umepata **njia yoyote ya kutekeleza msimbo** katika mwathirika. Kisha, [orodha ya zana zinazowezekana ndani ya mfumo ambazo unaweza kutumia kupata shell ya kurudi itakuwa ya manufaa sana](reverse-shells/).
|
|
|
|
Haswa katika Windows unaweza kuhitaji msaada wa **kuepuka antiviruses**: [**Angalia ukurasa huu**](../windows-hardening/av-bypass.md)**.**\\
|
|
|
|
### 8- Ndani
|
|
|
|
Ikiwa una matatizo na shell, unaweza kupata hapa **mkusanyiko mdogo wa amri muhimu zaidi** kwa wapentester:
|
|
|
|
* [**Linux**](../linux-hardening/useful-linux-commands.md)
|
|
* [**Windows (CMD)**](../windows-hardening/basic-cmd-for-pentesters.md)
|
|
* [**Windows (PS)**](../windows-hardening/basic-powershell-for-pentesters/)
|
|
|
|
### **9 -** [**Uhamishaji**](exfiltration.md)
|
|
|
|
Huenda ukahitaji **kutoa data kutoka kwa mwathirika** au hata **kuingiza kitu** (kama vile skripti za kupandisha mamlaka). **Hapa una** [**post kuhusu zana za kawaida ambazo unaweza kutumia kwa madhumuni haya**](exfiltration.md)**.**
|
|
|
|
### **10- Kupandisha Mamlaka**
|
|
|
|
#### **10.1- Privesc za Mitaa**
|
|
|
|
Ikiwa wewe si **root/Msimamizi** ndani ya sanduku, unapaswa kutafuta njia ya **kupandisha mamlaka.**\
|
|
Hapa unaweza kupata **mwongozo wa kupandisha mamlaka kwa ndani katika** [**Linux**](../linux-hardening/privilege-escalation/) **na katika** [**Windows**](../windows-hardening/windows-local-privilege-escalation/)**.**\
|
|
Unapaswa pia kuangalia hizi kurasa kuhusu jinsi **Windows inavyofanya kazi**:
|
|
|
|
* [**Uthibitishaji, Akidi, Mamlaka ya Token na UAC**](../windows-hardening/authentication-credentials-uac-and-efs/)
|
|
* Jinsi [**NTLM inavyofanya kazi**](../windows-hardening/ntlm/)
|
|
* Jinsi ya [**kuiba akidi**](https://github.com/carlospolop/hacktricks/blob/master/generic-methodologies-and-resources/broken-reference/README.md) katika Windows
|
|
* Mbinu kadhaa kuhusu [_**Active Directory**_](../windows-hardening/active-directory-methodology/)
|
|
|
|
**Usisahau kuangalia zana bora za kuorodhesha njia za Kupandisha Mamlaka za ndani za Windows na Linux:** [**Suite PEAS**](https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite)
|
|
|
|
#### **10.2- Privesc za Kihistoria**
|
|
|
|
Hapa unaweza kupata [**mbinu inayofafanua hatua za kawaida za kuorodhesha, kupandisha mamlaka na kudumu kwenye Active Directory**](../windows-hardening/active-directory-methodology/). Hata kama hii ni sehemu tu ya sehemu, mchakato huu unaweza kuwa **nyeti sana** katika kazi ya Pentesting/Red Team.
|
|
|
|
### 11 - POST
|
|
|
|
#### **11**.1 - Kuiba
|
|
|
|
Angalia ikiwa unaweza kupata zaidi **nywila** ndani ya mwenyeji au ikiwa una **ufikiaji kwa mashine nyingine** zikiwa na **mamlaka** ya **mtumiaji wako**.\
|
|
Pata hapa njia tofauti za [**kutoa nywila katika Windows**](https://github.com/carlospolop/hacktricks/blob/master/generic-methodologies-and-resources/broken-reference/README.md).
|
|
|
|
#### 11.2 - Kudumu
|
|
|
|
**Tumia aina 2 au 3 tofauti za mitambo ya kudumu ili usihitaji kuathiri mfumo tena.**\
|
|
**Hapa unaweza kupata baadhi ya** [**mbinu za kudumu kwenye active directory**](../windows-hardening/active-directory-methodology/#persistence)**.**
|
|
|
|
TODO: Kamilisha kudumu Post katika Windows & Linux
|
|
|
|
### 12 - Pivoting
|
|
|
|
Kwa **akidi zilizokusanywa** unaweza kuwa na ufikiaji kwa mashine nyingine, au labda unahitaji **kugundua na kuskan wenyeji wapya** (anza tena Mbinu ya Pentesting) ndani ya mitandao mipya ambapo mwathirika wako ameunganishwa.\
|
|
Katika kesi hii, tunneling inaweza kuwa muhimu. Hapa unaweza kupata [**post inayozungumzia tunneling**](tunneling-and-port-forwarding.md).\
|
|
Bila shaka unapaswa pia kuangalia post kuhusu [Mbinu ya pentesting ya Active Directory](../windows-hardening/active-directory-methodology/). Huko utapata mbinu nzuri za kuhamasisha, kupandisha mamlaka na kutoa akidi.\
|
|
Angalia pia ukurasa kuhusu [**NTLM**](../windows-hardening/ntlm/), inaweza kuwa ya manufaa sana kuhamasisha katika mazingira ya Windows.
|
|
|
|
### ZAIDI
|
|
|
|
#### [Programu za Android](../mobile-pentesting/android-app-pentesting/)
|
|
|
|
#### **Kuvunja**
|
|
|
|
* [**Kuvunja Msingi wa Linux**](broken-reference/)
|
|
* [**Kuvunja Msingi wa Windows**](../binary-exploitation/windows-exploiting-basic-guide-oscp-lvl.md)
|
|
* [**Zana za kuvunja za Msingi**](../binary-exploitation/basic-stack-binary-exploitation-methodology/tools/)
|
|
|
|
#### [**Python ya Msingi**](python/)
|
|
|
|
#### **Mbinu za Crypto**
|
|
|
|
* [**ECB**](../crypto-and-stego/electronic-code-book-ecb.md)
|
|
* [**CBC-MAC**](../crypto-and-stego/cipher-block-chaining-cbc-mac-priv.md)
|
|
* [**Padding Oracle**](../crypto-and-stego/padding-oracle-priv.md)
|
|
|
|
<figure><img src="../.gitbook/assets/image (1) (1) (1) (1) (1) (1) (1) (1) (1) (1).png" alt=""><figcaption></figcaption></figure>
|
|
|
|
Ikiwa unavutiwa na **kazi ya hacking** na kuweza kuvunja yasiyoweza kuvunjwa - **tunatafuta wafanyakazi!** (_kuandika na kuzungumza kwa Kiswahili vizuri kunahitajika_).
|
|
|
|
{% embed url="https://www.stmcyber.com/careers" %}
|
|
|
|
{% hint style="success" %}
|
|
Jifunze na fanya mazoezi ya AWS Hacking:<img src="../.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="../.gitbook/assets/arte.png" alt="" data-size="line">\
|
|
Jifunze na fanya mazoezi ya GCP Hacking: <img src="../.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="../.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
|
|
|
<details>
|
|
|
|
<summary>Support HackTricks</summary>
|
|
|
|
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
|
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuatilie** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
|
* **Shiriki mbinu za hacking kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
|
|
|
</details>
|
|
{% endhint %}
|