113 - Pentesting Ident - HackTricks

Search…

About the author

Getting Started in Hacking

Pentesting Methodology

External Recon Methodology

Phishing Methodology

Tunneling and Port Forwarding

Brute Force - CheatSheet

Search Exploits

Shells

Shells (Linux, Windows, MSFVenom)

Linux/Unix

Checklist - Linux Privilege Escalation

Linux Privilege Escalation

Useful Linux Commands

Linux Environment Variables

MacOS

MacOS Security & Privilege Escalation

Windows

Checklist - Local Windows Privilege Escalation

Windows Local Privilege Escalation

Active Directory Methodology

Stealing Credentials

Authentication, Credentials, UAC and EFS

Basic CMD for Pentesters

Basic PowerShell for Pentesters

Mobile Apps Pentesting

Android APK Checklist

Android Applications Pentesting

iOS Pentesting Checklist

Pentesting

Pentesting Network

Pentesting JDWP - Java Debug Wire Protocol

Pentesting Printers

Pentesting Kubernetes

7/tcp/udp - Pentesting Echo

21 - Pentesting FTP

22 - Pentesting SSH/SFTP

23 - Pentesting Telnet

25,465,587 - Pentesting SMTP/s

43 - Pentesting WHOIS

53 - Pentesting DNS

69/UDP TFTP/Bittorrent-tracker

79 - Pentesting Finger

80,443 - Pentesting Web Methodology

88tcp/udp - Pentesting Kerberos

110,995 - Pentesting POP

111/TCP/UDP - Pentesting Portmapper

113 - Pentesting Ident

123/udp - Pentesting NTP

135, 593 - Pentesting MSRPC

137,138,139 - Pentesting NetBios

139,445 - Pentesting SMB

143,993 - Pentesting IMAP

161,162,10161,10162/udp - Pentesting SNMP

194,6667,6660-7000 - Pentesting IRC

264 - Pentesting Check Point FireWall-1

389, 636, 3268, 3269 - Pentesting LDAP

500/udp - Pentesting IPsec/IKE VPN

502 - Pentesting Modbus

512 - Pentesting Rexec

513 - Pentesting Rlogin

514 - Pentesting Rsh

515 - Pentesting Line Printer Daemon (LPD)

548 - Pentesting Apple Filing Protocol (AFP)

554,8554 - Pentesting RTSP

623/UDP/TCP - IPMI

631 - Internet Printing Protocol(IPP)

873 - Pentesting Rsync

1026 - Pentesting Rusersd

1080 - Pentesting Socks

1098/1099/1050 - Pentesting Java RMI - RMI-IIOP

1433 - Pentesting MSSQL - Microsoft SQL Server

1521,1522-1529 - Pentesting Oracle TNS Listener

1723 - Pentesting PPTP

1883 - Pentesting MQTT (Mosquitto)

2049 - Pentesting NFS Service

2301,2381 - Pentesting Compaq/HP Insight Manager

2375, 2376 Pentesting Docker

3128 - Pentesting Squid

3260 - Pentesting ISCSI

3299 - Pentesting SAPRouter

3306 - Pentesting Mysql

3389 - Pentesting RDP

3632 - Pentesting distcc

3690 - Pentesting Subversion (svn server)

4369 - Pentesting Erlang Port Mapper Daemon (epmd)

5000 - Pentesting Docker Registry

5353/UDP Multicast DNS (mDNS)

5432,5433 - Pentesting Postgresql

5601 - Pentesting Kibana

5671,5672 - Pentesting AMQP

5800,5801,5900,5901 - Pentesting VNC

5984,6984 - Pentesting CouchDB

5985,5986 - Pentesting WinRM

6000 - Pentesting X11

6379 - Pentesting Redis

8009 - Pentesting Apache JServ Protocol (AJP)

9000 - Pentesting FastCGI

9001 - Pentesting HSQLDB

9042/9160 - Pentesting Cassandra

9100 - Pentesting Raw Printing (JetDirect, AppSocket, PDL-datastream)

9200 - Pentesting Elasticsearch

10000 - Pentesting Network Data Management Protocol (ndmp)

11211 - Pentesting Memcache

15672 - Pentesting RabbitMQ Management

27017,27018 - Pentesting MongoDB

44818/UDP/TCP - Pentesting EthernetIP

47808/udp - Pentesting BACNet

50030,50060,50070,50075,50090 - Pentesting Hadoop

Pentesting Web

Web Vulnerabilities Methodology

Reflecting Techniques - PoCs and Polygloths CheatSheet

Abusing hop-by-hop headers

Bypass Payment Process

Cache Poisoning and Cache Deception

Client Side Template Injection (CSTI)

Command Injection

Content Security Policy (CSP) Bypass

Cookies Hacking

CORS - Misconfigurations & Bypass

CRLF (%0D%0A) Injection

Cross-site WebSocket hijacking (CSWSH)

CSRF (Cross Site Request Forgery)

Dangling Markup - HTML scriptless injection

Deserialization

Domain/Subdomain takeover

Email Header Injection

File Inclusion/Path traversal

Formula Injection

HTTP Request Smuggling / HTTP Desync Attack

JWT Vulnerabilities (Json Web Tokens)

NoSQL injection

OAuth to Account takeover

Parameter Pollution

PostMessage Vulnerabilities

Rate Limit Bypass

Registration Vulnerabilities

Regular expression Denial of Service - ReDoS

Reset/Forgotten Password Bypass

Server Side Inclusion/Edge Side Inclusion Injection

SSRF (Server Side Request Forgery)

SSTI (Server Side Template Injection)

Reverse Tab Nabbing

Unicode Normalization vulnerability

Web Tool - WFuzz

XPATH injection

XSLT Server Side Injection (Extensible Stylesheet Languaje Transformations)

XXE - XEE - XML External Entity

XSS (Cross Site Scripting)

XSSI (Cross-Site Script Inclusion)

Forensics

Basic Forensic Methodology

A.I. Exploiting

BRA.I.NSMASHER Presentation

Blockchain

Blockchain & Crypto Currencies

Courses and Certifications Reviews

INE Courses and eLearnSecurity Certifications Reviews

Cloud Security

Cloud Security Review

Physical attacks

Physical Attacks

Escaping from KIOSKs

Reversing

Reversing Tools & Basic Methods

Common API used in Malware

Cryptographic/Compression Algorithms

Exploiting

Linux Exploiting (Basic) (SPA)

Exploiting Tools

Windows Exploiting (Basic Guide - OSCP lvl)

Cryptography

Cipher Block Chaining CBC-MAC

Crypto CTFs Tricks

Electronic Code Book (ECB)

Hash Length Extension Attack

RC4 - Encrypt&Decrypt

BACKDOORS

Stego

Esoteric languages

MISC

Other Big References

TODO

Other Web Tricks

Interesting HTTP

Emails Vulnerabilities

Android Forensics

6881/udp - Pentesting BitTorrent

1911 - Pentesting fox

Online Platforms with API

Stealing Sensitive Information Disclosure from a Web

Post Exploitation

Powered By GitBook

113 - Pentesting Ident

Basic Information
Is an Internet protocol that helps identify the user of a particular TCP connection.
Default port: 113
1
PORT    STATE SERVICE
2
113/tcp open  ident
Copied!
Enumeration
Manual - Get user/Identify the service
If a machine is running the service ident and samba (445) and you are connected to samba using the port 43218. You can get which user is running the samba service by doing:
If you just press enter when you conenct to the service:
Other errors:
Nmap
By default (-sC) nmap will identify every user of every running port:
1
PORT    STATE SERVICE     VERSION
2
22/tcp  open  ssh         OpenSSH 4.3p2 Debian 9 (protocol 2.0)
3
|_auth-owners: root
4
| ssh-hostkey: 
5
|   1024 88:23:98:0d:9d:8a:20:59:35:b8:14:12:14:d5:d0:44 (DSA)
6
|_  2048 6b:5d:04:71:76:78:56:96:56:92:a8:02:30:73:ee:fa (RSA)
7
113/tcp open  ident
8
|_auth-owners: identd
9
139/tcp open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: LOCAL)
10
|_auth-owners: root
11
445/tcp open  netbios-ssn Samba smbd 3.0.24 (workgroup: LOCAL)
12
|_auth-owners: root
Copied!
Ident-user-enum
Ident-user-enum is a simple PERL script to query the ident service (113/TCP) in order to determine the owner of the process listening on each TCP port of a target system. The list of usernames gathered can be used for password guessing attacks on other network services. It can be installed with apt install ident-user-enum.
1
[email protected]:/opt/local/recon/192.168.1.100# ident-user-enum 192.168.1.100 22 113 139 445
2
ident-user-enum v1.0 ( http://pentestmonkey.net/tools/ident-user-enum )
3
​
4
192.168.1.100:22  root
5
192.168.1.100:113 identd
6
192.168.1.100:139 root
7
192.168.1.100:445 root
Copied!
Shodan
oident
Files
identd.conf
HackTricks Automatic Commands
1
Protocol_Name: Ident    #Protocol Abbreviation if there is one.
2
Port_Number:  113     #Comma separated if there is more than one.
3
Protocol_Description: Identification Protocol         #Protocol Abbreviation Spelled out
4
​
5
Entry_1:
6
  Name: Notes
7
  Description: Notes for Ident
8
  Note: |
9
    Is an Internet protocol that helps identify the user of a particular TCP connection.
10
​
11
    https://book.hacktricks.xyz/pentesting/113-pentesting-ident
12
​
13
Entry_2:
14
  Name: Enum Users
15
  Description: Enumerate Users
16
  Note: apt install ident-user-enum    ident-user-enum {IP} 22 23 139 445 (try all open ports)
Copied!

Pentesting - Previous

111/TCP/UDP - Pentesting Portmapper

Next - Pentesting

123/udp - Pentesting NTP

Last modified 2mo ago

Copy link

Contents

Basic Information

Manual - Get user/Identify the service

Ident-user-enum

HackTricks Automatic Commands