# Internal Pentest CheatSheet

#### Identify used internal networks ranges

```bash
nmap 10.0.0.0/8
nmap 172.16.0.0/12
nmap 192.168.0.0/16
```

#### Identify hosts

```bash
arp-scan -l
netdiscover
```

#### Identify Breached Credntials

```bash
# https://github.com/hmaverickadams/breach-parse
bash breach-parse.sh @company.com company.com "BreachCompilation/"
```

#### Port 139, 445  - SMB

```bash
# Nmap SMB scripts scan
sudo nmap -sS  192.168.0.0/24 --script "smb*" -p445

# MS17-010 SMB RCE Detection
auxiliary/scanner/smb/smb_ms17_010
```

#### Port 22 - SSH

<pre class="language-bash"><code class="lang-bash"><strong># Brute Force
</strong><strong>hydra -l root -P unix_passwords.txt ssh://192.168.0.1:22 -t 10
</strong>auxiliary/scanner/ssh/ssh_login
</code></pre>

Shares

```
https://github.com/SnaffCon/Snaffler
```

**AD Checklis**

<pre><code><strong>✓ Absence de contrôle d'accès au réseau (NAC)
</strong>    - ip a ; ifconfig ; ipconfig => attribution automatique d'IP
✓ Serveurs / Contrôleurs de domaine obsolètes
    - nxc smb IPs.txt
<strong>✓ Partages exposés avec données personnelles
</strong><strong>    - nxc smb IP --shares
</strong></code></pre>

Hash Lookup

```
https://ntlm.pw
```
