Pentest-Service-Enumeration
Purpose
Suggests binaries to run against services found during the enumeration phase of a Pentest
Background
While studying for the Offensive Security Certified Profesional (OSCP) certification I found it hard to keep track of which commands to run during the enumeration phase for specific services.
The purpose of this tool is easily keep track of those commands.
Install Instructions
git clone https://github.com/ssstonebraker/Pentest-Service-Enumeration
cd Pentest-Service-Enumeration
./install.sh
How to use
Pentest Service Enumeration: 0.0.2
----------------------------------------------------------------------------------------------------
LISTING EXISTING COMMANDS:
Usage: pse <service-name> (Ex: ftp, rdp, http)
-v: verbose - print command description
Examples
[*] pse ftp
[*] pse -v ftp (for verbose)
----------------------------------------------------------------------------------------------------
STORING A NEW COMMAND WITH ARGUMENTS
Usage: pse -a <service-name> '<command> <arg1> <argX>'
note: You must use single quotes around your command
Examples
[*] pse -a rpc 'rpcinfo $IP'
[*] pse -a smb 'smbexec.py $HOST/$USERNAME:$PASSWORD@$IP'
----------------------------------------------------------------------------------------------------
Screenshots
Basic Usage
To view basic usage just type:
pse
List all available Services
pse -l
[*] listing all services that have pse stored commands
ftp
http
linpriv
mimikatz
rpc
smb
smtp
snmp
ssh
webdav
Listing commands for a service
pse <service-name>
Example:
pse smb
Default view
The default view does not include descriptions for commands
Verbose view
The verbose view includes descriptions for commands
pse -v <service-name>
Example:
pse -v smb
Adding commands for a service
In this example I am adding the dirb command for the https service
Before
I'm listing out what already exists for the http service
Add the command
Add command dirb for service http
pse -a http 'dirb http://$IP -r -o $OUTPUTFILE'
After
A view of the commands for the http service after I've added the dirb http command:
Variable Expansion
Currently only $IP and $PORT will be expanded (if set)
Example:
IP=10.11.1.10 pse http
