Thread by @techhacker98

LEARNING OSCP: Day #8
Initial Access tips #1
1. Don't rely on a single wordlist. I had instances where I couldn't find a hidden directory with dirbuster list, I got it when I ran with the dirb big.txt.
2. Don't forget to add extensions to directories: php, txt, html, etc.
#oscp

3. Try default passwords on every login function, ftp, ssh, mysql, smb, webdav, pop, etc. Search for the default creds for a specific web software and try to apply an educated guess if the original ones don't work.
4. Always check the source code, for usernames, passwords, etc.

5. Bruteforce all authenticated services with identified strings which look like usernames.
6. Use README.txt/LICENSE.txt/CHANGELOG.txt for enumerating service versions.
7. Not every exploit is available on searchsploit, many times custom exploits from google/github work fine.

8. Port 4444 doesn't always work for reverse connection, target common ports like 80/443 (and where the current service is running) that are likely to be open.
9. I prefer the nc mkfifo payload as it works most of times, but keep trying others like python, php, if they don't.

10. If a payload doesn't work, identify if the command is really installed in the machine, with 'which nc' or 'whereis nc'. Use the given name or full path and try the payload again.
11. Always carefully observe the web content, there might be hints given for the next steps.