blackbox

Full Black-Box Penetration Test

Overview

This command executes a complete automated penetration testing methodology against a target HTB machine. It follows the standard pentest phases: Reconnaissance → Enumeration → Exploitation → Privilege Escalation.

Prerequisites

• nmap installed and accessible
• gobuster or feroxbuster for web fuzzing
• nikto for web vulnerability scanning
• crackmapexec for Windows/AD enumeration
• hydra for credential attacks
• curl/wget for file transfers

Execution Flow

Phase 1: Environment Setup

First, verify all required tools are installed:

# Check core tools
which nmap gobuster nikto crackmapexec hydra

If tools are missing, inform the user and suggest installation commands.

Phase 2: Initial Reconnaissance

Run comprehensive port scanning:

# Quick scan for common ports
nmap -sC -sV -oN nmap_initial.txt <TARGET>

# Full TCP port scan (run in background)
nmap -p- -T4 -oN nmap_full.txt <TARGET>

# UDP scan for top ports
sudo nmap -sU --top-ports 20 -oN nmap_udp.txt <TARGET>

Phase 3: Service Enumeration

Based on discovered ports, run targeted enumeration:

For HTTP/HTTPS (80, 443, 8080):

# Directory fuzzing
gobuster dir -u http://<TARGET> -w /usr/share/wordlists/dirb/common.txt -o gobuster.txt

# Vulnerability scan
nikto -h http://<TARGET> -o nikto.txt

For SMB (445):

# Share enumeration
crackmapexec smb <TARGET> --shares
smbclient -L //<TARGET> -N

For SSH (22):

# Banner grab and version check
nc -nv <TARGET> 22

For DNS (53):

# Zone transfer attempt
dig axfr @<TARGET> <DOMAIN>

Phase 4: Vulnerability Identification

Based on enumeration results:

1. Search for known exploits using searchsploit
2. Check for default credentials
3. Identify misconfigurations
4. Look for information disclosure

searchsploit <service_name> <version>

Phase 5: Exploitation Guidance

Based on findings, suggest:

1. Exploit modules (Metasploit or manual)
2. Credential attacks if login forms found
3. File upload vulnerabilities
4. Command injection vectors