pentest-commands

name	pentest-commands
description	Provide a comprehensive command reference for penetration testing tools including network scanning, exploitation, password cracking, and web application testing. Enable quick command lookup during security assessments.
type	skill
created	2026-02-27T00:00:00.000Z
domain	security
category	pentesting
risk	offensive
source	community
tags	["skill","security","pentesting","pentest","commands"]

AUTHORIZED USE ONLY: Use this skill only for authorized security assessments, defensive validation, or controlled educational environments.

Pentest Commands

Purpose

Provide a comprehensive command reference for penetration testing tools including network scanning, exploitation, password cracking, and web application testing. Enable quick command lookup during security assessments.

Inputs/Prerequisites

• Kali Linux or penetration testing distribution
• Target IP addresses with authorization
• Wordlists for brute forcing
• Network access to target systems
• Basic understanding of tool syntax

Outputs/Deliverables

• Network enumeration results
• Identified vulnerabilities
• Exploitation payloads
• Cracked credentials
• Web vulnerability findings

Core Workflow

1. Nmap Commands

Host Discovery:

# Ping sweep
nmap -sP 192.168.1.0/24

# List IPs without scanning
nmap -sL 192.168.1.0/24

# Ping scan (host discovery)
nmap -sn 192.168.1.0/24

Port Scanning:

# TCP SYN scan (stealth)
nmap -sS 192.168.1.1

# Full TCP connect scan
nmap -sT 192.168.1.1

# UDP scan
nmap -sU 192.168.1.1

# All ports (1-65535)
nmap -p- 192.168.1.1

# Specific ports
nmap -p 22,80,443 192.168.1.1

Service Detection:

# Service versions
nmap -sV 192.168.1.1

# OS detection
nmap -O 192.168.1.1

# Comprehensive scan
nmap -A 192.168.1.1

# Skip host discovery
nmap -Pn 192.168.1.1

NSE Scripts:

# Vulnerability scan
nmap --script vuln 192.168.1.1

# SMB enumeration
nmap --script smb-enum-shares -p 445 192.168.1.1

# HTTP enumeration
nmap --script http-enum -p 80 192.168.1.1

# Check EternalBlue
nmap --script smb-vuln-ms17-010 192.168.1.1


nmap --script smb-vuln-ms08-067 192.168.1.1


nmap --script ssh-brute -p 22 192.168.1.1


nmap --script ftp-anon 192.168.1.1


nmap --script dns-brute 192.168.1.1


nmap -p80 --script http-methods 192.168.1.1


nmap -p80 --script http-headers 192.168.1.1


nmap --script http-sql-injection -p 80 192.168.1.1