KALI
5-Minute recon
Here's a five-minute recon workflow in Kali.
Start with whoami to confirm who you are, then check your interfaces. Run an nmap ping sweep to find live hosts on the subnet, three are up.
Pick one and scan it with service and version detection: an SSH server, and nginx on the web ports. Fingerprint the site with whatweb, it's running WordPress.
Then search exploit-db with searchsploit for known issues in that version. That's how you go from an IP range to a real target in minutes.
Always with permission.
# los comandos
kali@kali:~$ whoamicopiarkali
kali@kali:~$ ip -br -c acopiarlo UNKNOWN 127.0.0.1/8
eth0 UP 10.0.0.50/24
kali@kali:~$ nmap -sn 10.0.0.0/24copiarNmap scan report for 10.0.0.1 (router)
Nmap scan report for 10.0.0.5 (web-01)
Nmap scan report for 10.0.0.20 (nas)
Nmap done: 256 IPs (3 hosts up) in 2.13s
kali@kali:~$ nmap -sV -F 10.0.0.5copiarPORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 9.2p1
80/tcp open http nginx 1.24.0
443/tcp open https nginx 1.24.0
kali@kali:~$ whatweb http://10.0.0.5copiarhttp://10.0.0.5 [200 OK] nginx[1.24.0],
HTTPServer[nginx/1.24.0], WordPress[6.5]
kali@kali:~$ searchsploit wordpress 6.5copiar------------------------------- ----------
Exploit Title | Path
------------------------------- ----------
WordPress 6.5 - Auth Bypass | php/web
Solo con permiso. Esto se muestra con fines educativos y defensivos: úsalo únicamente en sistemas propios o donde tengas autorización. Entender el ataque es lo que te permite defenderte de él.