Initial Recon & Methodology

Where every engagement starts — host/port discovery, general methodology, OSINT, and mindset.

#recon#methodology#osint#enum

Initial Recon & Methodology

Methdology

Good starting points:

1. Initial Recon

2. AD Checklist

3. Standalones Checklist

Hey there!

I really hope you enjoy using the Obsidian OSCP Methodology version of these notes. Please note that some .md files might trigger antivirus software (AV) due to the inclusion of certain commands. As a result, some commands have been defanged throughout the files for safety.

There may be more nodes added as I continue updating the notes. If you'd prefer to avoid triggering your AV software, you can either:

Give it an exclusion path to prevent false positives
Run the scripts as they are, if nothing triggers your AV, you're good to go!

I really hope these notes help you crush your OSCP exam and serve as a solid reference for future work. Best of luck!

Cheers and please enjoy! :) - Hack Academy

Initial Recon

Network Scanning:

🐺 howlsec@kalicode

01nmap -p- -Pn $target -v --min-rate 1000 --max-rtt-timeout 1000ms --max-retries 5 -oN nmap_ports.txt && sleep 5 && nmap -Pn $target -sV -sC -v -oN nmap_sVsC.txt && sleep 5 && nmap -T5 -Pn $target -v --script vuln -oN nmap_vuln.txt 
02rustscan --ulimit 5000 -a $target -- -sC -sV -Pn -oN nmap_full

Web Content Discovery:

Directories:

🐺 howlsec@kalicode

01gobuster dir -u <http://$target> -w /usr/share/seclists/Discovery/Web-Content/raft-large-directories.txt -t 50 -o gb_dirs.txt
02gobuster dir -u <http://$target> -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 50 -o gb_dirs2.txt

Files:

🐺 howlsec@kalicode

01gobuster dir -u <http://$target> -w /usr/share/seclists/Discovery/Web-Content/common.txt -t 50 -x php,asp,xml,html,js,sql,gz,zip -r -o gb_files.txt
02gobuster dir -u <http://$target> -w /usr/share/seclists/Discovery/Web-Content/raft-large-files.txt -t 50 -x php,asp,xml,html,js,sql,gz,zip -r -o gb_files2.txt

Wordlists:

🐺 howlsec@kalicode

01/usr/share/seclists/Discovery/Web-Content/common.txt
02/usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
03/usr/share/seclists/Discovery/Web-Content/raft-large-directories-lowercase.txt
04 
05/usr/share/seclists/Discovery/Web-Content/big.txt
06/usr/share/seclists/Discovery/Web-Content/raft-large-files.txt
07/usr/share/seclists/Discovery/Web-Content/raft-large-words.txt