Questions tagged [pivoting]
The pivoting tag has no usage guidance.
14
questions
0
votes
1
answer
65
views
In case of multiple websites using a single IP, and we have been asked to perform vulnerability assessment to ensure its security, how many to target
When doing black-box vulnerability assessment (with permission of course) of a subdomain of a website, the first step is enumeration; and the first step of that is finding IP of the subdomain.
If you ...
- 121
0
votes
0
answers
68
views
How to double hop pivot?
I have a networking routing problem which I am unable to find a solution for:
I have a first machine, 192.168.51.103 (Windows), which is linked to subnet 172.16.51.0/24. To access this subnet, I first ...
1
vote
0
answers
26
views
How do I reach the "remote" web app using IP routing? (locally reaching another subnet with VPN to get to an app) [closed]
I have a PCAP basically stating two things:
An ARP request who has 192.168.a.b? Tell 192.168.b.c
An ARP answer with the MAC address follows of course.
The following requests all access an web app, ...
- 1,556
0
votes
1
answer
146
views
Can attacker gain access to my private network application through pivoting and/or lateral movement?
I am using a public wifi network.
When I start a nodejs express server at my local system at port 3000, I can access that website on another device (that is connected to the same public wifi network) ...
- 15
0
votes
0
answers
427
views
How can I get a meterpreter session back to my attack box from subnet via pivot?
I have a lab I am dealing with and need help to get a meterpreter session on this win 7 system.
My buffer overflow works great back to the pivot box. However since my attack box is not reachable from ...
- 101
1
vote
0
answers
117
views
call http-webpage in local browser, where the webserver is only reachable through proxychains (as it sits in a different network)
I have the following proxychains.conf
[...]
[ProxyList]
# add proxy here ...
# meanwile
# defaults set to "tor"
#socks4 127.0.0.1 9050
# <ip_prox_1>
http 10.10.10.100 3128
# ...
- 111
0
votes
1
answer
2k
views
pivoting without metasploit to get reverse shell
I have an exam next week. I need help.
This is my lab:
attacker machine (kali) : 192.168.1.81
1st hacked machine (Windows 10) : 10.10.10.130
target (Windows 7) : 10.10.10.135 (...
- 111
1
vote
0
answers
1k
views
How to use Chisel for Port Forwarding?
I'm getting started learning pentesting and I came across this situation.
Privilege Escalation
Running WinPeas I noticed a change to escalation bypass UAC. I was thinking to use a local exploit (...
1
vote
1
answer
406
views
Meterpreter pivot with a bind_named_pipe
I have a pivot setup on a compromised windows 10 box and am trying to get an SYSTEM shell on a separate machine in the target network. I have successfully done this abusing an unquoted service path ...
- 199
0
votes
1
answer
871
views
How to stop outgoing SSH on port 443
Let us say that a small company has an internal network for employees. All employees are granted Internet access via a NAT device (not a proxy) and perimeter firewall only allows outgoing connections ...
- 155
1
vote
1
answer
776
views
Help understanding pivoting and port forwading
I am trying to learn about pivoting/port forwarding and how to take full advantage of it. If I am connected to a network with the ip 192.168.0.10 and can see that 192.168.0.11 has access to a website ...
- 11
0
votes
0
answers
248
views
ms08_067_netapi exploit & pivoting problem
I'm having troubles with ms08_067_netapi.
I have a private network with a web server (10.10.2.10), windows 7 (10.10.2.8) and windows XP (10.10.2.9). I'm hacking from outside the private network with ...
- 1
1
vote
0
answers
904
views
Metasploit: Lateral movement with named pipe pivot
I‘m trying to demonstrate lateral movement to a windows machine that is not directly reachable and should connect back via named pipe:
Windows machine w1 does reverse_tcp/reverse_https to attacker.
...
- 1,111
3
votes
1
answer
1k
views
Metasploit: pivoting to machine without internet access
Let's imagine the following (not uncommon) scenario:
I'm doing a pentest from the outside
I have a meterpreter session from a company PC that´s within their infrastructure (Let´s say w/ reverse HTTPS)...
- 1,111