Python for Pentesters

Prompts and answers

• What other tool can be used to convert Python scripts to Windows executables?
  py2exe
• What other protocol could be used for subdomain enumeration?
  DNS
• What function does Python use to get the input from the command line?
  sys.argv
• How many directories can your script identify on the target system? (extensions are .html)
  4
• What is the location of the login page?
  private.html
• Where did you find a cryptic hash?
  apollo.html
• Where are the usernames located?
  surfer.html
• What is the password assigned to Rabbit?
  LOUSYRABBO
• What module was used to create the ARP request packets?
  scapy
• Which variable would you need to change according to your local IP block?
  ip_range
• What variable would you change to run this code on a system with the network interface named ens33?
  interface
• What protocol will most likely be using TCP port 22?
  SSH
• What module did we import to be able to use sockets?
  socket
• What function is likely to fail if we didn't import sys?
  sys.stdout.flush()
• How many ports are open on the target machine?
  3
• What is the highest port number open on the target system?
  2100
• What is the function used to connect to the target website?
  requests.get()
• What step of the Unified Cyber Kill Chain can PSexec be used in?
  Lateral Movement
• What is the hash you found during directory enumeration?
  cd13b6a6af66fb774faa589a9d18f906
• What is the cleartext value of this hash?
  rainbow
• Using the modified script find the cleartext value for 5030c5bd002de8713fef5daebd597620f5e8bcea31c603dccdfcdf502a57cc60
  redwings
• What package installer was used?
  pip3
• What line in this code would you change to stop the result from being printed on the screen?
  keyboard.play(keys)
• What username starting with the letter "t" did you find earlier?
  tiffany
• What is the SSH password of this user?
  trustno1
• What is the content of the flag.txt file?
  THM-737390028