john --rules --wordlist=/usr/share/wordlists/rockyou.txt unshadowed.txt
```
## Interesting files
## Tcp-dump
```
#Meterpreter
search -f *.txt
search -f *.zip
search -f *.doc
search -f *.xls
search -f config*
search -f *.rar
search -f *.docx
search -f *.sql
.ssh:
.bash_history
```
## Mail
```
/var/mail
/var/spool/mail
```
## Tcp-dump
Fast command:
```
tcpdump -i any -s0 -w capture.pcap
tcpdump -i eth0 -w capture -n -U -s 0 src not 192.168.1.X and dst not 192.168.1.X
tcpdump -vv -i eth0 src not 192.168.1.X and dst not 192.168.1.X
```
If you are on a network with other machines that you still haven't owned, it might be useful to take a tcp-dump from the machine you have owned. So that you can inspect the traffic between that machine and the other machines on the network. This might be helpful when attacking the other machines.
So after we have exploited a machine we want to use that machine to learn as much about the network as possbible. To be able to map the entire network. We want to know about switches, firewalls, routers, other computers, server, etc. We want to know what ports are open, their operating systems.
1. First we need to figure out what interfaces the machine is using.
- Ifconfig. Then we can just start tapping in on that and start to record it.
First we need to figure out what interfaces the machine is using: `ifconfig`. Then we can just start tapping in on that and start to capture those packets.
### Commands and flags
Let's start with the basics.
tcpdump - this command will output all network traffic straight to the terminal. Might be hard to understand if there is a lot of traffic.
`tcpdump` - this command will output all network traffic straight to the terminal. Might be hard to understand if there is a lot of traffic.
**-A** - stands for Ascii, and output it in ascii.
`-A` - stands for Ascii, and output it in ascii.
**-w file.pcap ** - the w-flag will save the output into the filename of your choice. The traffic is stored in pcap-format, which is the standard packet-analysis-format.
`-w file.pcap` - the w-flag will save the output into the filename of your choice. The traffic is stored in pcap-format, which is the standard packet-analysis-format.
**-i any ** - will record traffic for all interfaces.
`-i any` - will capture traffic for all interfaces.
**-D** - show list of all interfaces
`-D` - show list of all interfaces
**-q** - be less verbose. Be more **quiet**
`-q` - be less verbose. Be more `quiet`
**-s** - The default size that tcpdump captures is only 96 bytes. If you want it to capture more you have to define it yourself `-s0` gives you the whole packet.
`-s` - The default size that tcpdump captures is only 96 bytes. If you want it to capture more you have to define it yourself `-s0` gives you the whole packet.
**-c** - count. Set how many packets you want to intercept. And then stop.
`-c` - count. Set how many packets you want to intercept. And then stop. Is useful if you have a non-interactive shell, this way to can capture packets without having to leave with `ctr-c`.
**port 22** - only see traffic on a specific port.
`port 22` - only see traffic on a specific port.
**-vvv** - Verbose. Depending on how verbose you want the output.
`-vvv` - Verbose. Depending on how verbose you want the output.
@@ -72,7 +92,8 @@ sudo tcpdump -i wlan0 src port 80 or dst port 80 -w port-80-recording.pcap
sudo tcpdump -i eth0 src port 80 or dst port 80 -w port-80-recording.pcap
```
Print the traffick in hex with ascii interpretation.
Print the traffic in hex with ascii interpretation.
```
tcpdump -nX -r file.pcap
```
@@ -84,9 +105,9 @@ tcpdump tcp -w file.pcap
```
## Sniffing for passwords
### Sniffing for passwords
Once we have dumped some of the traffic we can insert it into metasploit and run `psnuffle` on it. It can sniff passwords and usernames from pop3, imap, ftp, and HTTP GET. This is a really easy way to find usernames and passwords from traffic that you have already dumped, or are in the process of dumping.
Once we have dumped some of the traffic we can insert it into metasploit and run `psnuffle` on it. It can sniff passwords and usernames from **pop3**, **imap**, **ftp**, and **HTTP GET**. This is a really easy way to find usernames and passwords from traffic that you have already dumped, or are in the process of dumping.
