Sublist3r is a python tool designed to enumerate subdomains of websites using OSINT.

Puerto 21 (FTP) ¿Puedo iniciar sesión de forma anónima y descargar algunos archivos? ¿Puedo iniciar sesión de forma anónima y cargar algunos archivos? — aquí estaría buscando algún tipo de divulgación de información u oportunidad para una carga de shell inversa.

SSH ¿Puedo forzar las credenciales e iniciar sesión en el host? ¿Pude encontrar tokens rsa, nombres de usuario, hash o contraseñas durante mi proceso de enumeración que pudieran ayudarme? ¿Qué versión de servicio encontré asociada con este puerto? ¿Es vulnerable?

(Administración remota): Ah, esto debe ser un entorno de Windows, veamos si puedo enumerar algunas credenciales y usar una herramienta como EvilWinRM para obtener más acceso.

This shell is the ultimate WinRM shell for hacking/pentesting.

WinRM (Windows Remote Management) is the Microsoft implementation of WS-Management Protocol. A standard SOAP based protocol
that allows hardware and operating systems from different vendors to interoperate. Microsoft included it in their Operating
Systems in order to make life easier to system administrators.

This program can be used on any Microsoft Windows Servers with this feature enabled (usually at port 5985), of course only
if you have credentials and permissions to use it. So we can say that it could be used in a post-exploitation hacking/pentesting
phase. The purpose of this program is to provide nice and easy-to-use features for hacking. It can be used with legitimate
purposes by system administrators as well but the most of its features are focused on hacking/pentesting stuff.

It is based mainly in the WinRM Ruby library which changed its way to work since its version 2.0. Now instead of using WinRM
protocol, it is using PSRP (Powershell Remoting Protocol) for initializing runspace pools as well as creating and processing pipelines.

CrackMapExec (a.k.a CME) is a post-exploitation tool that helps automate assessing the security of large Active Directory networks. Built with stealth in mind, CME follows the concept of "Living off the Land": abusing built-in Active Directory features/protocols to achieve it's functionality and allowing it to evade most endpoint protection/IDS/IPS solutions.
CME makes heavy use of the Impacket library for working with network protocols and performing a variety of post-exploitation techniques.
Although meant to be used primarily for offensive purposes (e.g. red teams, internal pentest), CME can be used by blue teams as well to assess account privileges, find possible misconfigurations and simulate attack scenarios.

¿Hay alguna oportunidad para el control de acceso roto ? ¿Puedo manipular la URL para darme acceso a una cuenta/directorio que no debería tener?

privilege escalation,
winpeas,
windows

WinPEAS is a script that search for possible paths to escalate privileges on Windows hosts.

privilege escalation,
winpeas,
windows

LinPEAS is a script that search for possible paths to escalate privileges on Linux/Unix*/MacOS hosts

privilege escalation,
winpeas,
linux

privilege escalation,
windows

Windows x32/x64 program to extract passwords, hash, PINs, and Kerberos tickets from memory

privilege escalation,
windows,
kerberos,
hash,
paswords,
tikets

Learn how to hack like a pro by a pro. 25 hours of up to date practical hacking techniques with absolutely no filler. create active directory environment.

muestra los vectores Priv Esc de Windows en función de las configuraciones incorrectas del sistema . DO NOT use the auto-exploit modules

windows,
privilege escalation

privilege escalation,
windows

Empire is a post-exploitation framework that includes a pure-PowerShell2.0 Windows agent, and a pure Python 2.6/2.7 Linux/OS X agent