mirror of
https://github.com/carlospolop/hacktricks
synced 2024-11-23 13:13:41 +00:00
170 lines
11 KiB
Markdown
170 lines
11 KiB
Markdown
# Mbinu ya Pentesting
|
|
|
|
<details>
|
|
|
|
<summary><strong>Jifunze AWS hacking kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
|
|
|
|
Njia nyingine za kusaidia HackTricks:
|
|
|
|
* Ikiwa unataka kuona **kampuni yako ikionekana kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MIPANGO YA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
|
* Pata [**bidhaa rasmi za PEASS & HackTricks**](https://peass.creator-spring.com)
|
|
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
|
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
|
* **Shiriki mbinu zako za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
|
|
|
</details>
|
|
|
|
<figure><img src="../.gitbook/assets/image (1) (1) (1) (1).png" alt=""><figcaption></figcaption></figure>
|
|
|
|
Ikiwa una nia ya **kazi ya udukuzi** na kudukua yasiyodukuzika - **tunakupa kazi!** (_inahitajika uwezo wa kuandika na kuzungumza Kipolishi kwa ufasaha_).
|
|
|
|
{% embed url="https://www.stmcyber.com/careers" %}
|
|
|
|
## Mbinu ya Pentesting
|
|
|
|
<figure><img src="../.gitbook/assets/HACKTRICKS-logo.svg" alt=""><figcaption></figcaption></figure>
|
|
|
|
_Majina ya Hacktricks yalibuniwa na_ [_@ppiernacho_](https://www.instagram.com/ppieranacho/)_._
|
|
|
|
### 0- Mashambulizi ya Kimwili
|
|
|
|
Je! Una **upatikanaji wa kimwili** kwa mashine unayotaka kushambulia? Unapaswa kusoma baadhi ya [**mbinu kuhusu mashambulizi ya kimwili**](../hardware-physical-access/physical-attacks.md) na nyingine kuhusu [**kutoroka kutoka kwa programu za GUI**](../hardware-physical-access/escaping-from-gui-applications.md).
|
|
|
|
### 1 - [Kugundua mwenyeji ndani ya mtandao](pentesting-network/#discovering-hosts)/ [Kugundua Mali za kampuni](external-recon-methodology/)
|
|
|
|
**Kulingana** na **jaribio** unalofanya ikiwa ni **jaribio la ndani au nje** unaweza kuwa unavutiwa na kutafuta **wenyeji ndani ya mtandao wa kampuni** (jaribio la ndani) au **kugundua mali za kampuni kwenye mtandao** (jaribio la nje).
|
|
|
|
{% hint style="info" %}
|
|
Tambua kwamba ikiwa unafanya jaribio la nje, mara tu unapofanikiwa kupata ufikiaji wa mtandao wa ndani wa kampuni unapaswa kuanza mwongozo huu tena.
|
|
{% endhint %}
|
|
|
|
### **2-** [**Kucheza na mtandao**](pentesting-network/) **(Ndani)**
|
|
|
|
**Sehemu hii inatumika tu ikiwa unafanya jaribio la ndani.**\
|
|
Kabla ya kushambulia mwenyeji labda ungependa **kuiba baadhi ya vibali** **kutoka kwenye mtandao** au **kunusa** baadhi ya **data** kujifunza **kimya/kwa vitendo(MitM)** unaweza kupata nini ndani ya mtandao. Unaweza kusoma [**Pentesting Network**](pentesting-network/#sniffing).
|
|
|
|
### 3- [Uchunguzi wa Bandari - Kugundua Huduma](pentesting-network/#scanning-hosts)
|
|
|
|
Jambo la kwanza kufanya unapotafuta **mapungufu kwenye mwenyeji** ni kujua ni **huduma zipi zinazoendeshwa** kwenye bandari zipi. Hebu tuone [**zana za msingi za kutafuta bandari za wenyeji**](pentesting-network/#scanning-hosts).
|
|
|
|
### **4-** [Kutafuta udhaifu wa toleo la huduma](search-exploits.md)
|
|
|
|
Marafiki unapojua ni huduma zipi zinazoendeshwa, na labda toleo lao, unapaswa **kutafuta udhaifu uliojulikana**. Labda utapata bahati na kuna shambulio la kukupa kifaa...
|
|
|
|
### **5-** Huduma za Pentesting
|
|
|
|
Ikiwa hakuna shambulio la kipekee kwa huduma yoyote inayoendeshwa, unapaswa kutafuta **kosa la kawaida katika kila huduma inayoendeshwa.**
|
|
|
|
**Ndani ya kitabu hiki utapata mwongozo wa kudukua huduma za kawaida** (na zingine ambazo si za kawaida)**. Tafadhali, tafuta kwenye index ya kushoto** _**PENTESTING**_ **sehemu** (huduma zimepangwa kulingana na bandari zao za msingi).
|
|
|
|
**Nataka kufanya kumbukumbu maalum ya** [**Sehemu ya Pentesting Mtandao**](../network-services-pentesting/pentesting-web/) **(kwani ndio ndefu zaidi).**\
|
|
Pia, mwongozo mdogo juu ya jinsi ya [**kupata udhaifu uliojulikana katika programu**](search-exploits.md) unaweza kupatikana hapa.
|
|
|
|
**Ikiwa huduma yako haipo kwenye index, tafuta kwenye Google** kwa mafunzo mengine na **niambie ikiwa unataka niiongeze.** Ikiwa **hupati chochote** kwenye Google, fanya **udukuzi wako wa kipofu**, unaweza kuanza kwa **kuunganisha kwenye huduma, kufanya fujo na kusoma majibu** (ikiwa yapo).
|
|
|
|
#### 5.1 Zana za Kiotomatiki
|
|
|
|
Pia kuna zana kadhaa zinazoweza kufanya **tathmini za udhaifu kiotomatiki**. **Ningependekeza ujaribu** [**Legion**](https://github.com/carlospolop/legion)**, ambayo ni zana niliyounda na inategemea maelezo kuhusu kudukua huduma unazoweza kupata katika kitabu hiki.**
|
|
|
|
#### **5.2 Kuvunja-Nguvu huduma**
|
|
|
|
Katika hali fulani, **Kuvunja-Nguvu** inaweza kuwa na manufaa kwa **kuambukiza** **huduma**. [**Pata hapa Mwongozo wa haraka wa kuvunja-nguvu kwa huduma tofauti**](brute-force.md)**.**
|
|
|
|
### 6- [Udukuzi wa Mtandao](phishing-methodology/)
|
|
|
|
Ikiwa mpaka sasa hujapata udhaifu unaovutia **unaweza kuhitaji kujaribu udukuzi** ili kuingia kwenye mtandao. Unaweza kusoma mbinu yangu ya udukuzi [hapa](phishing-methodology/):
|
|
|
|
### **7-** [**Kupata Shell**](shells/)
|
|
|
|
Kwa namna fulani unapaswa kuwa umepata **njia ya kutekeleza nambari** kwenye mhanga. Kisha, [orodha ya zana zinazowezekana ndani ya mfumo ambazo unaweza kutumia kupata shell ya nyuma itakuwa muhimu sana](shells/).
|
|
|
|
Hasa kwenye Windows unaweza kuhitaji msaada wa kuepuka **antivirus**: [**Angalia ukurasa huu**](../windows-hardening/av-bypass.md)**.**\\
|
|
|
|
### 8- Ndani
|
|
|
|
Ikiwa una matatizo na shell, unaweza kupata hapa **mkusanyiko mdogo wa amri muhimu zaidi** kwa wadukuzi:
|
|
|
|
* [**Linux**](../linux-hardening/useful-linux-commands.md)
|
|
* [**Windows (CMD)**](../windows-hardening/basic-cmd-for-pentesters.md)
|
|
* [**Winodows (PS)**](../windows-hardening/basic-powershell-for-pentesters/)
|
|
|
|
### **9 -** [**Kutoa Nje**](exfiltration.md)
|
|
|
|
Labda utahitaji **kutoa baadhi ya data kutoka kwa mhanga** au hata **kuweka kitu** (kama hati za uongezaji wa mamlaka). **Hapa una** [**chapisho kuhusu zana za kawaida unazoweza kutumia kwa madhumuni haya**](exfiltration.md)**.**
|
|
### **10- Ukarabati wa Mamlaka**
|
|
|
|
#### **10.1- Ukarabati wa Mamlaka wa Kienyeji**
|
|
|
|
Ikiwa **hauko kama root/Administrator** ndani ya sanduku, unapaswa kupata njia ya **kukarabati mamlaka.**\
|
|
Hapa unaweza kupata **mwongozo wa kukarabati mamlaka kienyeji katika** [**Linux**](../linux-hardening/privilege-escalation/) **na katika** [**Windows**](../windows-hardening/windows-local-privilege-escalation/)**.**\
|
|
Pia unapaswa kuangalia kurasa hizi kuhusu jinsi **Windows inavyofanya kazi**:
|
|
|
|
* [**Uthibitisho, Vitambulisho, Mamlaka ya Token na UAC**](../windows-hardening/authentication-credentials-uac-and-efs/)
|
|
* Jinsi [**NTLM inavyofanya kazi**](../windows-hardening/ntlm/)
|
|
* Jinsi ya [**kuiba vitambulisho**](https://github.com/carlospolop/hacktricks/blob/master/generic-methodologies-and-resources/broken-reference/README.md) kwenye Windows
|
|
* Mbinu kadhaa kuhusu [_**Active Directory**_](../windows-hardening/active-directory-methodology/)
|
|
|
|
**Usisahau kuangalia zana bora za kuhesabu njia za Ukarabati wa Mamlaka wa Kienyeji kwenye Windows na Linux:** [**Suite PEAS**](https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite)
|
|
|
|
#### **10.2- Ukarabati wa Mamlaka ya Kikoa**
|
|
|
|
Hapa unaweza kupata [**methodology inayoeleza hatua za kawaida za kuhesabu, kukarabati mamlaka na kudumu kwenye Active Directory**](../windows-hardening/active-directory-methodology/). Hata kama hii ni sehemu tu ya sehemu, mchakato huu unaweza kuwa **wa kugusa sana** kwenye kazi ya Pentesting/Red Team.
|
|
|
|
### 11 - POST
|
|
|
|
#### **11.1 - Uporaji**
|
|
|
|
Angalia kama unaweza kupata **maneno ya siri zaidi** ndani ya mwenyeji au kama una **upatikanaji wa mashine nyingine** na **mamlaka** ya **mtumiaji wako**.\
|
|
Pata njia tofauti za [**kudump maneno ya siri kwenye Windows**](https://github.com/carlospolop/hacktricks/blob/master/generic-methodologies-and-resources/broken-reference/README.md) hapa.
|
|
|
|
#### 11.2 - Kudumu
|
|
|
|
**Tumia aina 2 au 3 tofauti za mbinu za kudumu ili usihitaji kudukua mfumo tena.**\
|
|
**Hapa unaweza kupata mbinu za** [**kudumu kwenye active directory**](../windows-hardening/active-directory-methodology/#persistence)**.**
|
|
|
|
TODO: Kamilisha Post ya kudumu kwenye Windows & Linux
|
|
|
|
### 12 - Kupindua
|
|
|
|
Kwa **vitambulisho vilivyokusanywa** unaweza kupata upatikanaji wa mashine nyingine, au labda unahitaji **kugundua na kutafuta mwenyeji mpya** (anza tena Mbinu ya Pentesting) ndani ya mitandao mipya ambapo mwathiriwa wako ameunganishwa.\
|
|
Katika kesi hii, tunnelling inaweza kuwa muhimu. Hapa unaweza kupata [**post inayozungumzia kuhusu tunnelling**](tunneling-and-port-forwarding.md).\
|
|
Bila shaka unapaswa pia kuangalia post kuhusu [Methodolojia ya Pentesting ya Active Directory](../windows-hardening/active-directory-methodology/). Huko utapata mbinu za kusonga upande, kukarabati mamlaka na kudump vitambulisho.\
|
|
Angalia pia ukurasa kuhusu [**NTLM**](../windows-hardening/ntlm/), inaweza kuwa na manufaa sana kwa kupindua kwenye mazingira ya Windows..
|
|
|
|
### ZAIDI
|
|
|
|
#### [Maombi ya Android](../mobile-pentesting/android-app-pentesting/)
|
|
|
|
#### **Kudukua**
|
|
|
|
* [**Kudukua Msingi wa Linux**](../binary-exploitation/linux-exploiting-basic-esp.md)
|
|
* [**Kudukua Msingi wa Windows**](../binary-exploitation/windows-exploiting-basic-guide-oscp-lvl.md)
|
|
* [**Zana za Msingi za Kudukua**](../binary-exploitation/basic-binary-exploitation-methodology/tools/)
|
|
|
|
#### [**Python Msingi**](python/)
|
|
|
|
#### **Mbinu za Crypto**
|
|
|
|
* [**ECB**](../crypto-and-stego/electronic-code-book-ecb.md)
|
|
* [**CBC-MAC**](../crypto-and-stego/cipher-block-chaining-cbc-mac-priv.md)
|
|
* [**Oracle ya Padding**](../crypto-and-stego/padding-oracle-priv.md)
|
|
|
|
<figure><img src="../.gitbook/assets/image (1) (1) (1) (1).png" alt=""><figcaption></figcaption></figure>
|
|
|
|
Ikiwa una nia ya **kazi ya udukuzi** na kudukua yasiyoweza kudukuliwa - **tunakupa kazi!** (_inahitajika uwezo wa kuzungumza na kuandika Kipolishi kwa ufasaha_).
|
|
|
|
{% embed url="https://www.stmcyber.com/careers" %}
|
|
|
|
<details>
|
|
|
|
<summary><strong>Jifunze udukuzi wa AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
|
|
|
|
Njia nyingine za kusaidia HackTricks:
|
|
|
|
* Ikiwa unataka kuona **kampuni yako ikitangazwa kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MIPANGO YA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
|
* Pata [**bidhaa rasmi za PEASS & HackTricks**](https://peass.creator-spring.com)
|
|
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) ya kipekee
|
|
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
|
* **Shiriki mbinu zako za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
|
|
|
</details>
|