Port Tracker
Pick a service. Follow the checklist. Every command is copy-paste ready.
Windows file sharing — enumerate shares, users, null sessions, and hunt for readable/writable shares.
5 steps →Secure Shell — grab version, enumerate auth methods, spray creds, and hunt for weak keys.
4 steps →Web servers — fingerprint, directory brute, parameter fuzz, and hunt for CVEs.
6 steps →AD authentication — enumerate users, AS-REP roast, Kerberoast, and ticket attacks.
4 steps →MySQL/MariaDB — test weak creds, dump databases, and hunt for FILE privilege.
3 steps →Microsoft SQL Server — enumerate, then xp_cmdshell / impersonation / linked servers for RCE.
3 steps →Remote Desktop — check NLA, spray creds, and connect. Watch for BlueKeep.
3 steps →Windows Remote Management — the preferred lateral movement path. Evil-WinRM for shells.
3 steps →Directory service — anonymous binds leak the whole AD tree: users, groups, descriptions.
3 steps →File Transfer Protocol — test anonymous login and check for writable dirs.
3 steps →Domain Name System — zone transfers, subdomain brute, and reverse lookups.
2 steps →Simple Network Management Protocol — brute community strings, then walk the MIB.
2 steps →Mail transfer — enumerate users via VRFY/EXPN/RCPT, test open relay.
2 steps →PostgreSQL — weak creds, then dump data or RCE via COPY ... PROGRAM.
3 steps →Redis KV store — unauthenticated by default. Dump keys or write files for RCE.
2 steps →RPC portmapper — lists RPC services, often reveals NFS.
2 steps →Network File System — list exports, mount them, hunt for SUID privesc.
2 steps →