Practical Offensive Security Masterclass | From Recon to Root

So let me start with the objective first.

So I have one machine and this machine like we have this machine, entire infrastructure is Linux.

And with the like interesting part, like isn't a single vulnerability.

The machine focus us to change several weakness together.

what i i am going to do let me first take let me edit something here let me see whether i can write the text or not yes i can do so now the first thing is like how this channel vulnerability look like so the first thing i have an internet and you can see if you are doing a pen test in the real environment then there can be the two scenario the first one is uh uh the external uh pen testing and the second one is internal pen testing

so in

the external pen testing definitely you will get the ip uh list of the ip from the uh like your client or either if you are doing a bug bounty or something like that then definitely you will get a scope to perform the pen testing

yeah

now there there are some scenario in the red team where client says you have to identify our asset and whatever you will get, that will cover under the scope and you have to perform entire pen testing and you have to find the way to get inside our network.

This will be your first approach.

Second approach is like kind of assume brief where like client will give you the system, they will give you the internet access, they will call you at their office and they will ask you to perform the entire recon, to perform the attack surface, uh they will give you the entire like even they will not give you the details sometimes they can give you the release of the ip address and sometimes you have to find the entire subnet of the ips so the it depends uh client to client so here i am taking it as a assumed reach okay so uh the same thing like But if I take an example, another example, if there is no assumed scenario on the internet, I have to find the IP.

Then there are lots of tools, threat intel tools out there.

You have to just put the IP like the name of the company.

It will give you the entire asset of that company.

Otherwise, you can go to the Sodan.

You can go to the search engine, open browser.

You can use the Google Doc to identify entire IPs off.

any of the company like assets so uh the similar just consider like i am connected with the open vpn or i am connected uh within the in like in client infrastructure so they have given me one this one system now from there i have to perform the attack so i have a one ip address as well so this attack chain will look like like uh like the internet the first thing i will do the recon the first and the most initial part of the penetration testing or offensive security you have to gather the information whatever is possible So in Raycon, you can get the detail of the ports.

You can get a detail of the services.

Then you can look for the banner information.

You can look for the information related to net BIOS and the open ports, like based upon the TCP scan, UDP scan.

And you have to run, like there are lots of things.

So after recon, take an example.

If you have received like 445 port is open, that belongs to SMB.

And now you also know the version of the SMBs and also you went online, you search for the exploit and you get the exploit like around CBs or something XYZ.