misc updates

Author: frankheat

content/android/_index.md

@@ -1,5 +1,5 @@
 ---
-title: "Android"
+title: "ANDROID"
 menu: "main"
 weight: 1
 ---

content/android/adb.md

@@ -7,25 +7,47 @@ weight: 5
 
 ## Commands
 
-```sh
-# Install apk
+Install apk
+```bash
 adb install <path.apk>
+```
 
-# Lists all installed packages
+Uninstalls the application
+```sh
+adb shell am start <package_name>/<activity_name>
+```
+
+Clear the application data
+```sh
+adb shell pm clear <package_name>
+```
+
+Lists all installed packages
+```sh
 adb shell pm list packages
+```
 
-# List only third party packages
+List only third party packages
+```sh
 adb shell pm list packages -3
+```
 
-# Clear the application data
-adb shell pm clear <package_name>
-
-# List information such as activities and permissions of a package
+List information such as activities and permissions of a package
+```sh
 adb shell dumpsys package <package_name>
+```
 
-# Starts the activity of the specified package
+Starts the activity of the specified package
+```sh
 adb shell am start <package_name>/<activity_name>
+```
 
-# Uninstalls the application
-adb shell am start <package_name>/<activity_name>
+Copy a file from the device
+```sh
+adb pull <remote-file> <local-file>
+```
+
+Copy a file on the device
+```sh
+adb push <local-file> <destination-directory>
 ```

content/android/vulnerabilities/deep-link.md

@@ -77,7 +77,7 @@ Because of Link Hijacking. This happen when a malicious app registers an URI tha
 Suppose that:
 
 * The victim user have malicious app installed
-* Both apps (victim and malicious) manage `geo://` , `https://google.com`
+* Both apps (victim and malicious) manage `geo://`, `https://google.com`
 
 | **Android** | **Victim App installed** | **Link supported** | **URI**            | **Behavior**                                       |
 |-------------|--------------------------|--------------------|--------------------|----------------------------------------------------|

content/misc/_index.md

@@ -1,5 +1,5 @@
 ---
-title: "Misc"
+title: "MISC"
 menu: "main"
 weight: 4
 ---

content/misc/password-cracking.md

@@ -41,18 +41,21 @@ hydra -L user.txt -P pass.txt <ip> <protocol>
 ## Rules (password bruteforce)
 
 * **FIRST CHOICE**:  best64 (now best66). Fast, works well.
-  * [https://github.com/hashcat/hashcat/blob/master/rules/best66.rule](https://github.com/hashcat/hashcat/blob/master/rules/best66.rule)
+  * [best66.rule](https://github.com/hashcat/hashcat/blob/master/rules/best66.rule)
 * **SECOND/THIRD CHOICE**: InsidePro-PasswordsPro (\~3000) && InsidePro-Hashmanager (\~7000)
-  * (2) [https://github.com/hashcat/hashcat/blob/master/rules/InsidePro-PasswordsPro.rule](https://github.com/hashcat/hashcat/blob/master/rules/InsidePro-PasswordsPro.rule)
-  * (3) [https://github.com/hashcat/hashcat/blob/master/rules/InsidePro-HashManager.rule](https://github.com/hashcat/hashcat/blob/master/rules/InsidePro-HashManager.rule)
+  * (2) [InsidePro-PasswordsPro.rule](https://github.com/hashcat/hashcat/blob/master/rules/InsidePro-PasswordsPro.rule)
+  * (3) [InsidePro-HashManager.rule](https://github.com/hashcat/hashcat/blob/master/rules/InsidePro-HashManager.rule)
   * You can also combine them...
 * **FOURTH CHOICE**: OneRuleToRuleThemAll. (\~50k). The best.
-  * [https://github.com/NotSoSecure/password\_cracking\_rules/blob/master/OneRuleToRuleThemAll.rule](https://github.com/NotSoSecure/password_cracking_rules/blob/master/OneRuleToRuleThemAll.rule)
+  * [OneRuleToRuleThemAll.rule](https://github.com/NotSoSecure/password_cracking_rules/blob/master/OneRuleToRuleThemAll.rule)
 
 **Generate wordlist based on rules**
 
-[https://weakpass.com/generate](https://weakpass.com/generate)&#x20;
-
+1. Online tool: [https://weakpass.com/generate](https://weakpass.com/generate)
+2. Hashcat:
+```bash
+hashcat -r best66.rule --stdout file.txt
+```
 
 
 **More info about rules:**

content/network/_index.md

@@ -1,5 +1,5 @@
 ---
-title: "Network"
+title: "NETWORK"
 menu: "main"
 weight: 3
 ---

content/network/network-services-exploitation.md

@@ -225,6 +225,13 @@ mysql -h <hostname> -u root -p
 * Brute force login
   * Try with `root` default user
 
+## 1433 - MSSQL
+
+```sh
+# Connect with password (NTLM auth)
+impacket-mssqlclient Administrator:pass<hostname> -windows-auth
+```
+
 ## 3389 - RDP
 
 ```sh

content/web/_index.md

@@ -1,6 +1,5 @@
 ---
-title: "Web"
-
+title: "WEB"
 menu: "main"
 weight: 2
 ---

content/web/automation.md content/web/reconnaissance.mdcontent/web/automation.md renamed to content/web/reconnaissance.md

@@ -1,15 +1,22 @@
 ---
-title: ""
+title: "Reconnaissance"
 weight: 3
 ---
 
-# Automation
+# Reconnaissance
 
 ## Enumerating web resources
 
 ```sh
 # Web fuzzer 
-ffuf -w wordlist.txt -u https://example.com/file-FUZZ -c
+ffuf -c -u https://example.com/file-FUZZ -w wordlist.txt
+
+# with extension
+ffuf -c -u https://example.com/FUZZ -w wordlist.txt -e .php,.html,.txt
+
+# with more placeholder
+ffuf -c -u http://example.com/FUZZ/FILE -w wordlist.txt:FUZZ -w wordlist2.txt:FILE 
+
 
 # Recursive content discovery
 # You can set depth (recursion), extract links from response body

content/web/vulnerabilities/os-command-injection.md

@@ -59,3 +59,15 @@ There are so many ways: [https://book.hacktricks.wiki/linux-hardening/bypass-bas
 `command`
 $(command)
 ```
+
+## Identify CMD or PowerShell
+
+To determine whether commands are executed by PowerShell or CMD, use this snippet:
+
+```cmd
+(dir 2>&1 *`|echo CMD);&<# rem #>echo PowerShell
+```
+
+## Reverse Shell Generator
+
+https://www.revshells.com/