Show Menu
Cheatography

Penetration Testing Cheat Sheet Cheat Sheet (DRAFT) by

Penetration Testing Cheat Sheet

This is a draft cheat sheet. It is a work in progress and is not finished yet.

Setting Up

Using apt
apt <CO­MMA­ND> <PA­CKA­GE>
Firefox Extensions
Wappal­yzer, Foxyproxy, HacKon­tent, Vulners
Note-T­aking
Obsidian, Pwndocs
Pwndocs This is a profes­sional Penetr­ation Testing report generator available Here

System Updates You can add custom commands to your
~/.bashrc
file to run things like system updates without having to type the whole apt command
echo "­alias sysupd­ate­='sudo apt-get update -y && sudo apt-get upgrade -y'” >> ~/. bashrc


To run this command, start a new terminal and type
sysupdate

Inform­ation Gathering

nslookup
Query All
nslookup -query=all <UR­L>
Name Server
nslookup -type=ns <UR­L>
Nmap
Check Open Ports
nmap -n -Pn -vvv <IP>
Scan w/Common Scripts
nmap -sSCV -Pn -A -vvv -p=<PO­RTS> <IP> --min-­rat­e=5000
Output Scan to Files
<nmap comman­d> -oA filename
Change XML to HTML
xlstproc filena­me.xml -o filena­me.html
Whois
whois <UR­L>
Dnsenum
dnsenum <UR­L>
Cyberchef
Replace
<>
with the respective info.
 

Exploi­tation

Metasploit
metasploit -q
Update
metasploit update
Docume­ntation
Multih­andler
Search­sploit
Vulner­ability Search
search­sploit <AP­PLI­CAT­ION>
download module
search­sploit -m <MODULE NUM>
Reverse Shell Generator
Netcat
Reverse Shell (Connect)
nc -lvnp <PO­RT>
Bind Shell (Connect)
nc <IP> <PO­RT>
rlwrap
rlwrap nc <..>
- Gives you more control
Pwncat - Python Netcat C2
 

Bruteforce Attacks

Hashcat
Find encodi­ng/­enc­ryption in help
hashcat -h | grep <EN­C>
JohnTh­eRipper
Cracks­tation - Rainbow Table
CrackM­apExec
WPScan
Hashcat
hashcat -h | grep md5

CrackM­apExec (CME)
Compre­hensive Guide
 

Wi-Fi Cracking

Airmon-ng - Monitor
Start listener on interface
airmon-ng start wlan0
Airodu­mp-ng - Dump
Select Interface
airodu­mp-ng wlan0
Dump Hashes
airodu­mp-ng -w <WO­RDL­IST> -c 1 --bssid <MA­C> wlan0
 
airodu­mp-ng -w Attack1 -c 1 --bssid E6:6F:­14:­31:­63:1C wlan0
Aircra­ck-ng - Crack
Crack Captured MAC
aircra­ck-ng -a2 -b <MA­C> -w <WO­RDL­IST> </p­ath­/to­/ca­ptu­re>
 
aircra­ck-ng -a2 -b E6:6F:­14:­31:­63:1C -w /root/­Des­kto­p/w­ord­lis­t.txt /root/­Des­kto­p/A­tta­ck1­-01.cap
Docume­ntation