---
description: >-
  This is a library documenting tools, their usage and functions for each stage
  in the pentest cycle, so I don't have to google every time.
---

# Pentest Tools Library

## OSCP Exam miscellaneous Tools

1. OBS for Recording the exam

## Enumeration

1. AutoRecon by Tib3rius

Allows for scanning multiple hosts concurrently

{% tabs %}
{% tab title="LinEnum.sh for Linux" %}
{% embed url="https://github.com/rebootuser/LinEnum" %}

Automated script to check for:

1. System info / User information (attempt to read /etc/shadow, list all users UID)
2. Privileged access - permissions and sudo access or root home access
3. Jobs/Cron
4. Services & Versions (Sudo, MYSQL, Postgres, Apache)
5. Searches&#x20;

{% embed url="https://null-byte.wonderhowto.com/how-to/use-linenum-identify-potential-privilege-escalation-vectors-0197225" %}
How to
{% endembed %}
{% endtab %}

{% tab title="Powerless / PowerUp for Windows" %}

{% endtab %}
{% endtabs %}

### Web App Enumeration

General rule of thumb is to leave web servers to the last. Non-http enumeration is simple, HTTP enumeration could take too much time.

* dirsearch / gobuster for directory or file enumeration, use wordlists like rockyou.txt
* Look at source code for HTML clues
* Learn wfuzz with payloads from PayloadAllTheThings and fuzzdb
* Proxy web app through Burp using repeater

## Privilege Escalation

The hardest even for the most experienced, do spend more time learning this and practicing.

{% embed url="https://github.com/sagishahar/lpeworkshop" %}
One of the best resources for learning Priv escalation
{% endembed %}

{% embed url="https://blog.g0tmi1k.com/2011/08/basic-linux-privilege-escalation" %}
Linux Priv Esc
{% endembed %}
