More notes because I can never remember and I'm sick of looking it up Testing open shares/445 List shares with smbclient -L 1.2.3.4 ...

Found a couple of fun PowerShell enumeration scripts here: https://github.com/PyroTek3/PowerShell-AD-Recon C:\temp>powershell -exe...

Scanning once you are on the LAN can pose a problem. Nmap requires installing pcap and usually an interactive install ( metacab is an opti...

So last assessment I got caught on the first internal port scan. Seems that all the internal routing was done via static routes so when I t...

"Fierce is a reconnaissance tool. Fierce is a PERL script that quickly scans domains (usually in just a few minutes, assuming no networ...

So while helping a buddy out with an audit we came across a mis-configured DNS server that allows zone transfers (I know, we couldn't be...

If you haven't heard of Paterva's Maltego (formally Evolution) then you've been missing out! HD Moore and Valsmith first mentio...

Sometimes nmap will tell you what you exactly what you are up against... cg@segfault:~$ nmap -A 192.168.1.15 Starting Nmap 4.20 ( http://ins...

Yeah so i was bored on the hotel wireless...errr lab...and started seeing who had ports 135, 139, 445 open. I found one guy running OS X 10...

Over in LSO-Chat we were talking about SNMP Enumeration and why you would want to do that and what kind of information you could pull from...