> For the complete documentation index, see [llms.txt](https://davin-hong3.gitbook.io/d/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://davin-hong3.gitbook.io/d/walkthroughs/cybersecurity-concepts/pentest-tools-library.md).

# Pentest Tools Library

This is a library documenting tools, their usage and functions for each stage in the pentest cycle, so I don't have to google every time.

## OSCP Exam miscellaneous Tools

1. OBS for Recording the exam

## Enumeration

1. AutoRecon by Tib3rius

Allows for scanning multiple hosts concurrently

{% tabs %}
{% tab title="LinEnum.sh for Linux" %}
{% embed url="<https://github.com/rebootuser/LinEnum>" %}

Automated script to check for:

1. System info / User information (attempt to read /etc/shadow, list all users UID)
2. Privileged access - permissions and sudo access or root home access
3. Jobs/Cron
4. Services & Versions (Sudo, MYSQL, Postgres, Apache)
5. Searches&#x20;

{% embed url="<https://null-byte.wonderhowto.com/how-to/use-linenum-identify-potential-privilege-escalation-vectors-0197225>" %}
How to
{% endembed %}
{% endtab %}

{% tab title="Powerless / PowerUp for Windows" %}

{% endtab %}
{% endtabs %}

### Web App Enumeration

General rule of thumb is to leave web servers to the last. Non-http enumeration is simple, HTTP enumeration could take too much time.

* dirsearch / gobuster for directory or file enumeration, use wordlists like rockyou.txt
* Look at source code for HTML clues
* Learn wfuzz with payloads from PayloadAllTheThings and fuzzdb
* Proxy web app through Burp using repeater

## Privilege Escalation

The hardest even for the most experienced, do spend more time learning this and practicing.

{% embed url="<https://github.com/sagishahar/lpeworkshop>" %}
One of the best resources for learning Priv escalation
{% endembed %}

{% embed url="<https://blog.g0tmi1k.com/2011/08/basic-linux-privilege-escalation>" %}
Linux Priv Esc
{% endembed %}