infrastructure

Files (48)

• SKILL.md
• dns-quickstart.md · reference/
• dos-quickstart.md · reference/
• firewall-detection.md · reference/
• hardware-embedded-quickstart.md · reference/
• icmp-scan.md · reference/
• ics-modbus-quickstart.md · reference/
• ics-protocols.md · reference/
• ip-reputation.md · reference/
• ipv6-quickstart.md · reference/
• mitm-quickstart.md · reference/
• os-fingerprint.md · reference/
• overview.md · reference/
• port-scanning-quickstart.md · reference/
• bind-tsig-key-hijack.md · reference/scenarios/dns/
• dns-cache-poisoning.md · reference/scenarios/dns/
• dns-rebinding.md · reference/scenarios/dns/
• subdomain-enumeration.md · reference/scenarios/dns/
• zone-transfer.md · reference/scenarios/dns/
• jtag-uart.md · reference/scenarios/hardware/
• ethernet-ip.md · reference/scenarios/ics/
• modbus.md · reference/scenarios/ics/
• s7comm.md · reference/scenarios/ics/
• ipv6-recon.md · reference/scenarios/ipv6/
• slaac-attack.md · reference/scenarios/ipv6/
• arp-poisoning.md · reference/scenarios/mitm/
• lldp-cdp-spoofing.md · reference/scenarios/mitm/
• ssl-stripping.md · reference/scenarios/mitm/
• alive-hosts-discovery.md · reference/scenarios/network-recon/
• cups-browsed-rce.md · reference/scenarios/network-recon/
• port-scanning-tcp-udp.md · reference/scenarios/network-recon/
• service-fingerprinting.md · reference/scenarios/network-recon/
• ntlm-relay-coercion.md · reference/scenarios/smb/
• null-and-guest-enumeration.md · reference/scenarios/smb/
• share-spidering.md · reference/scenarios/smb/
• smb-signing-misconfig.md · reference/scenarios/smb/
• credentials-from-pcap.md · reference/scenarios/sniffing/
• promiscuous-capture.md · reference/scenarios/sniffing/
• double-tagging.md · reference/scenarios/vlan-hopping/
• dtp-spoofing.md · reference/scenarios/vlan-hopping/
• service-enum.md · reference/
• smb-netbios-quickstart.md · reference/
• sniffing-quickstart.md · reference/
• syn-scan.md · reference/
• udp-scan.md · reference/
• upnp-iot-quickstart.md · reference/
• vlan-hopping-quickstart.md · reference/
• wifi-wpa-enterprise-quickstart.md · reference/

SKILL.md (first lines)

# Infrastructure

Test network infrastructure for vulnerabilities including network services, protocols, and perimeter security.

## Techniques

| Type | Key Vectors |
|------|-------------|
| **Port Scanning** | SYN scan, UDP scan, service detection, OS fingerprinting |
| **DNS** | Zone transfers, cache poisoning, subdomain takeover, DNS rebinding |
| **MITM** | ARP spoofing, DNS spoofing, SSL stripping, LLMNR/NBT-NS poisoning |
| **VLAN Hopping** | Switch spoofing, double tagging |
| **IPv6** | RA flooding, neighbor spoofing, tunneling attacks |
| **SMB/NetBIOS** | Null sessions, relay attacks, enumeration |
| **Sniffing** | Packet capture, credential harvesting, protocol analysis |
| **DoS** | Resource exhaustion, amplification, application-layer |
| **ICS/SCADA** | Modbus TCP, PLC exploitation, coil/register manipulation, session hijacking |
| **UPnP / IoT / CPE** | rootDesc/SCPD enumeration, vendor SOAP info disclosure (`GetPassword`), command injection via vendor actions, cross-action auth-key reuse |
| **Hardware / Embedded** | Logic captures (Saleae `.sal`), CAN/UART decoding, side-channel password recovery, legacy CPU errata, i386 tools via docker |

## Workflow

1. Network discovery and topology mapping
2. Port scanning and service enumeration
3. Protocol-specific vulnerability testing
4. Network attack execution (authorized scope only)
5. Evidence capture with packet captures and logs

## Reference

**Quickstart guides** (per attack type):
- `reference/port-scanning-quickstart.md` - Port scanning and service discovery
- `reference/dns-quickstart.md` - DNS attacks and enumeration
- `reference/mitm-quickstart.md` - Man-in-the-middle attacks
- `reference/vlan-hopping-quickstart.md` - VLAN hopping techniques
- `reference/ipv6-quickstart.md` - IPv6 attack vectors
- `reference/smb-netbios-quickstart.md` - SMB/NetBIOS exploitation
- `reference/sniffing-quickstart.md` - Network sniffing and capture
- `reference/dos-quickstart.md` - DoS assessment
- `reference/ics-modbus-quickstart.md` - ICS/SCADA Modbus PLC exploitation
- `reference/upnp-iot-quickstart.md` - UPnP / IoT / CPE firmware web UI enumeration and exploitation
- `reference/hardware-embedded-quickstart.md` - Logic captures, CAN/UART decoding, side-channel char-by-char recovery, legacy CPU bugs (6502), i386 tooling on ARM macOS

**Scan techniques**: `reference/syn-scan.md`, `reference/udp-scan.md`, `reference/icmp-scan.md`, `reference/os-fingerprint.md`
**Other**: `reference/firewall-detection.md`, `reference/service-enum.md`, `reference/ip-reputation.md`, `reference/overview.md`

From gohilrajbha0312/Pentest-tool, MIT.