Special Actions

Special Actions

Main → [4]. Higher-level operations: an automated multi-phase sweep, a focused vulnerability scan, privileged secret extraction, and a results viewer.

[1]  Auto Workflow (Full Scan)
[2]  SMB Vulnerabilities Scan
[3]  Secrets Dump (Requires Admin)
[4]  View Results
[0]  Back to Main Menu

---

[1] Auto Workflow

Runs the core passive modules back to back in one command, skipping any whose tool is missing. Phases:

Phase 1  Network Scan      nmap -p 88,135,139,389,445 -sV   → nmap.*
Phase 2  SMB Enumeration   enum4linux-ng -A                 → enum4linux.txt
Phase 3  RPC Enumeration   rpcclient null session           → rpc.txt
Phase 4  LDAP Query        ldapsearch (objectclass=user)    → ldap.txt

Needs target. Phase 4 only runs if a domain is set. Each phase writes its own file into the output directory. This is the fastest way to get broad coverage of a new target before drilling in manually.

---

[2] SMB Vulnerabilities Scan

Targeted Nmap NSE scan for known SMB vulnerabilities (MS17-010 / EternalBlue, SMBGhost, etc.).

nmap -p 445 --script 'smb-vuln*' <target> -oA <output>/smb_vulns

Needs target. Results saved in all Nmap formats as smb_vulns.*. A quick check for the classic critical SMB CVEs.

---

[3] Secrets Dump

⚠️ Requires privileged (administrative) credentials. Uses Impacket's secretsdump to extract password hashes and secrets from the target.

secretsdump.py <domain>/<user>:<pass>@<target> | tee secrets.txt

Needs target, domain and credentials. Resolves secretsdump.py or impacket-secretsdump. Returns NTLM hashes (SAM/NTDS), LSA secrets and cached credentials, the dumped hashes feed pass-the-hash or offline cracking (hashcat -m 1000).

Only run this once you hold administrative rights on the target and have explicit authorization. Hash material is highly sensitive, store secrets.txt accordingly and delete it when the engagement closes. See Legal & Safe Use.

---

[4] View Results

Lists the contents of the current output directory.

ls -lh <output>/

If nothing has been run yet (directory absent) it tells you so. Use it any time to confirm what has been collected. For the full meaning of each file, see Output & Results.

---

When to use the workflow vs. individual modules

• Auto Workflow — first contact with a target, or when you want broad passive coverage fast and will review the files afterward.
• Individual modules (Passive / Active) — when you already know which service is interesting and want full, unabridged output (the workflow suppresses per-tool noise to stay readable).