PEASS-ng VS SecLists

Once on a system, something like Linpeas or Winpeas would be useful: https://github.com/carlospolop/PEASS-ng

Reject internet, embrace man. TBH it is not usefull at all, it is just in manual or embedded in kali, like basic webshells for example. It is cool to do such thing as a little free time project to learn about hosting and developing a website, but usefulnes for broader audience is minimal I think. For everyday use https://book.hacktricks.xyz are the best in my opinion.

I'm taking my OSCP exam next Wednesday and was just wondering on what tools are actually prohibited and which are not. I'm specifically referring to linpeas, winpeas, seatbelt. I often times run these tools when I've exausted my enumeration methods for a quick find. Are these tools allowed on the AD set and the individual machines?

Seems like a cart before horse situation. Why not just release the cheat sheet you have now and see how it does? I like Carlos Polop's approach with HackTricks -- https://book.hacktricks.xyz/ -- he offers previews of new content to his patrons.

Hi I don't understand the self.files attribute in this code: https://github.com/carlospolop/PEASS-ng/blob/master/linPEAS/builder/src/fileRecord.py

I'd recommend poking around at github and see what you find. A good starting point is WinPEAS if you're looking for automation. Seatbelt might also be helpful

Using linpeas I found some useful information over the user steven

https://github.com/danielmiessler/SecLists/blob/master/Usernames/xato-net-10-million-usernames.txt is not enough usernames

This reminds me of [0] where they maintain composite lists of frequently used passwords. Also in the repo is probably my favorite pull request ever [1].

[0] https://github.com/danielmiessler/SecLists

[1] https://github.com/danielmiessler/SecLists/pull/155

Maybe swagger.txt

Typical of the sorts of information a tester/attacker might be using from: Daniel Miessler's SecLists

Oh, and then you have this.

You can now also enable a rule for password dictionary. Appwrite knows what are the most common passwords, and with this rule enabled, it will not allow you users to set any of those passwords. It prevents your users from having passwords like password, 123456678, or qwertyui. Appwrite currently knows the 10,000 most commonly used passwords thanks to the same list used by other industry-leading auth providers. You can check out the dictionary list on GitHub.

Try wifite if you don’t know how to use hashcat it is pretty simple. Hashcat is pretty easy as well I am to lazy to get on my laptop right now but just get the right wordlist Seclist has a shit load of them https://github.com/danielmiessler/SecLists

Fellow rust players know the way