Practical Web Penetration Testing

Service probing and enumeration

In the preceding step, we used the Nmap script to quickly probe each service that we found. In this step, we will take this information to the next step and try to probe aggressively. The Nmap scripts that we will use in the following examples are both very aggressive and time-consuming:

• Port TCP 21 – FTP:
  • Nmap script probing:

nmap -sV -p 21 -Pn -T5 --host-timeout 15m --script=ftp* -v [IP address]

• • Credential brute force:

hydra -t 10 -V -f -L [users dic file path] -P [passwords dic file path] ftp://[IP address]

• Port TCP 22 – SSH:
  • Nmap script probing:

nmap -sV -p 22 -Pn -T5 --host-timeout 15m --script=ssh* -v [IP address]

• • Credential brute force:

hydra -t 10 -V -f -L [users dic file path] ...