0

I have a cybersecurity test coming up. We have a practice test, but no solutions. One question involves being given a fresh Kali VM and a target IP on our subnet, and having to discover as many username/password combinations on the device as we can.

I have no idea how to even begin this process. Would someone mind giving me a general outline or the Kali tools involved in finding usernames and passwords on a computer in your subnet? I learned a little about nmap scanning, but don't know if that's even relevant to this question.

It also says that for each owned account, credit will be based on the most privileged group to which it belongs, then lists 3 group names along with point values. Does this mean that the process will be different depending on the group? How should I interpret this?

Any help or suggestions on where to start is greatly appreciated!

Improve this question

1 Answer 1

Reset to default
1

Your questions are fun ^^

Start with nmap, look for cheatsheats; n0where.net has all kinds of fun stuff to read about.

Maybe follow up with metasploit, there is a another vuln scanner I used to use quite often...I'll have to do some digging but, had pretty good luck with it. Its been about a year since I've written a detailed security assessment so, I'm a little rusty.

Again low hanging fruit. If you can find some vulnerability that allows you to gain access, someone has probably already written a script that does most of the work for you. You just need to identify weak points of your target. Try some vulnhub targets at home (probably what you guys are using).

If there is a web server built into whatever image (I presume) you guys are attacking take all of the usable information you can from that. Like look for company directory page, index, something like that and create usernames from it. I would make a list of last name first initial and first initial last name. Same thing if there is an ftp server.

Read up on John.

Make yourself a password list and those usernames you created, put them in the password list. I would put the company name in there too.

Get yourself a user list off of the target system. Put those in the password list.

https://askubuntu.com/questions/410244/a-command-to-list-all-users-and-how-to-add-delete-modify-users

http://www.cyberciti.biz/faq/linux-list-users-command/

I wouldn't start out trying to crack passwords from the get go. It is a long process sometimes. Try to focus on vulnerabilities, privilege escalation, pivoting.

Hope that helps or at least points you in the right direction.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .