> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/enum/discovery-introduction.md).

# Discovery - Introduction

The adversary is trying to figure out your environment.

{% hint style="info" %}
Please note that this site is a continuous **work-in-progress!**
{% endhint %}

**Discovery** consists of techniques an adversary may use to gain knowledge about the system and internal network. These techniques help adversaries observe the environment and orient themselves before deciding how to act. They also allow adversaries to explore what they can control and what’s around their entry point in order to discover how it could benefit their current objective. Native operating system tools are often used toward this post-compromise information-gathering objective.

Alternative names for discovery is enumeration, reconnaissance and system awareness.

## Discovery - Top Checklist

{% hint style="info" %}
NOTE

The code snippets below assumes you have set the environment variable `TARGET_IP` of the target machine with `export TARGET_IP=<machine_ip>`, e.g. `export TARGET_IP=10.129.227.113`.
{% endhint %}

### Basic OS fingerprinting

We can do a basic OS fingerprinting with `ping` and check the TTL-value of the response packet

```bash
ping -c 1 $TARGET_IP
```

### Service Discovery

#### TCP Scanning

TCP-service scanning on all ports with `nmap` including service info and default scripts

```bash
sudo nmap -sC -sV -p- $TARGET_IP
```

#### UDP Scanning

Additional UDP-scanning on top 100 UDP-ports with `nmap` including service info and default scripts

```bash
sudo nmap -sU --top-ports 100 -sV -sC $TARGET_IP
```

### Web Discovery

#### Basic Web Discovery

Basic web enumeration with `nmap`

```bash
nmap -v -p80 --script http-enum $TARGET_IP
```

Check for comments with `nmap`

```bash
nmap -v -p80 --script http-comments-displayer $TARGET_IP
```

Run all web discovery scripts on common HTTP ports

```bash
nmap -v -p 80,443,8080 --script "http-* and discovery" $TARGET_IP
```

Check the contents of the `robots.txt` file, if any

```bash
curl http://$TARGET_IP/robots.txt
```

Check the contents of the `sitemap.xml` file, if any

```bash
curl http://$TARGET_IP/sitemap.xml
```

#### Discover Files and Directories

Scan a Linux machine for interesting directory and files with `gobuster`

```bash
gobuster dir -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -r -t 32 -x php,txt,html -u http://$TARGET_IP
```

Scan for directories recursively with `ffuf` and a larger wordlist (no auto-calibration)

```bash
ffuf -c -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-big.txt -recursion -u http://$TARGET_IP/FUZZ/
```

To find out supported extensions with `ffuf`

```bash
ffuf -c -w /usr/share/seclists/Discovery/Web-Content/web-extensions.txt -ac -u http://$TARGET_IP/indexFUZZ 
```

#### Tech Stack Discovery

Get Tech Stack information with `whatweb`

```bash
whatweb -a3 $TARGET_IP
```

### SMB Discovery

#### List Shares

Scan for available shares with `NetExec` as an anonymous user (Null session)

```bash
nxc smb $TARGET_IP -u '' -p '' --shares
```

If anonymous access doesn't work, try connecting as `Guest`

```bash
nxc smb $TARGET_IP -u Guest -p '' --shares
```

#### List share content recursively

To list available files recursively with `smbmap`

```bash
smbmap -H $TARGET_IP --depth 5 -r <share_name> 
```

```bash
smbmap -H $TARGET_IP -u Guest --no-pass --depth 5 -r <share_name>
```

```bash
smbmap -H $TARGET_IP -u 'svc-alfresco' -p 's3rvice' -r NETLOGON --depth 5
```

To list available files recursively with `smbclient`

```bash
smbclient -N //$TARGET_IP/<share_name> -c 'recurse;ls'
```

#### Enumerating Domain Users

To enumerate all domain users (unauthenticated)

```bash
nxc smb $TARGET_IP -u '' -p '' --users 
```

To enumerate all domain users (authenticated)

```bash
nxc smb $TARGET_IP -u <user> -p '<password>' --users 
```

To create a file called `users.txt` with the result we can

```bash
nxc smb $TARGET_IP -u '<user>' -p '<password>' --users | grep -vE '[+]|[*]|-User' | awk '{print $5}' > users.txt
```

#### Recursively download files

To recursively download files from a specified SMB share

Without credentials:

```bash
smbget --recursive "smb://$TARGET_IP/<share_name>"
```

With credentials:

```bash
smbget --recursive --user=<user>%<pw> "smb://$TARGET_IP/<share_name>"
```

### FTP Discovery

#### FTP Exploration

Connect as anonymous

```bash
ftp anonymous@$TARGET_IP
```

Traverse the directory structure and list all files

```bash
ls -la
```

Finally, check for write-access (possibility to drop a reverse shell?).

#### FTP Download

To download all files from the FTP-server recursively with `wget`

```bash
wget -r ftp://anonymous@remote-server
```

## Resources

Discovery (TA0007) - Mitre ATT\&CK: <https://attack.mitre.org/tactics/TA0007/>