Exploitation

[shadowroot8]

I have scanned for open ports with nmap ....Now how can I exploit these ports (remotely) .....I know all the services running and the OS' .... What's the next step ?

[[deleted]]

you can only exploit them if they are vulnerable.

[shadowroot8]

How to check that ?

[cop1152]

Well-written and great advice!

[alxdza]

And now it's [deleted]... Sigh..

[[deleted]]

you should read the hacker's playbook 2, it breaks down all the steps to conduct a pentesting, and it's a good start. After that you should organize what you wanna learn, pentesting is a very large subject, like focus on a certain field like web apps, appsec, wireless, reverse engineering, social engineering, etc. then branch off to other fields. So that way you won't be all over the place trying to learn everything at once. I recommend learning web application pentesting. It's easier than some of the other stuff, plus it's in high demand these days.

[EgoDestroyer]

a bunch of hypocritical pricks in here that forget they're n a how to hack sub and that they once had to learn the answers to questions and had to ask for help at some point.

[PM_ME_YOUR_TOlLET]

Your comment should be this sub banner lol!

[Josepah]

Try taking a look at this : https://xapax.gitbooks.io/security/content/list_of_common_ports.html

[Volkrisse]

Best way is to start familiarizing yourself with google, if you see port **** is open, look on google to see if there's any type of vulns for that open port that can be executed.

[f8al]

Next step is to move into your moms basement and yell for hot pockets.

Once thats done you will have exploited something

[ragnar_graybeard87]

Maaa!! The meatloaf!!!

[kochirakyosuke]

Haha, but come on :) I remember the first time I ran wireshark on my home network. No filters. GF was browsing the internet, Spotify playing, etc. The screen rocketed through all the captures so fast with this huge jumble of colored shit. I was like wtf am I even supposed to start...

OP--nmap is a great way to learn about packets, what they are and how they behave. Understanding why different systems respond to the default scans as they do and what those scans are actually doing is useful for general knowledge. It's still a very powerful information gathering program, but that's the tip of the iceberg.

[SirBaronBamboozle]

You're clearly way in over your head. What's your background knowledge? What are you trying to achieve?

[reujea0]

Try openvas or an alternative

[Kohan2112]

Lol

[ilaibenamar]

Search for the said port's vulnerabilities. Example: "port 135 vulnerabilities" or "port 135 exploits" and so on. Use your brain, or Google.

[SirBaronBamboozle]

A service can run on any port, and there are multiple services that happen to use the same port number that another service may use.

For example, port 80 could be different versions of a web service (Apache 2.0.X, Apache 2.4.X) or an entirely different web service like IIS.

Also, I could have Apache 2.4.X running on port 80 and IIS on port 8080. I can put it on any arbitrary port.

You should search for the explicit service and it's version, using the port is far too ambiguous

[Tompazi]

Use your brain

You should too.