Penetration Testing Tools Cheat Sheet

• Introduction
  • Changelog
• Pre-engagement
  • Network Configuration
    • Set IP Address
    • Subnetting
• OSINT
  • Passive Information Gathering
    • DNS
      • WHOIS enumeration
      • Perform DNS IP Lookup
      • Perform MX Record Lookup
      • Perform Zone Transfer with DIG
• DNS Zone Transfers
  • Email
    • Simply Email
  • Semi Active Information Gathering
    • Basic Finger Printing
    • Banner grabbing with NC
  • Active Information Gathering
    • DNS Bruteforce
      • DNSRecon
    • Port Scanning
      • Nmap Commands
        • Nmap UDP Scanning
        • UDP Protocol Scanner
        • Other Host Discovery
• Enumeration & Attacking Network Services
  • SAMB / SMB / Windows Domain Enumeration
    • Samba Enumeration
      • SMB Enumeration Tools
      • Fingerprint SMB Version
      • Find open SMB Shares
      • Enumerate SMB Users
      • Manual Null session testing:
      • NBTScan unixwiz
  • LLMNR / NBT-NS Spoofing
    • Metasploit LLMNR / NetBIOS requests
    • Responder.py
  • SNMP Enumeration Tools
    • SNMPv3 Enumeration Tools
  • R Services Enumeration
    • RSH Enumeration
      • RSH Run Commands
      • Metasploit RSH Login Scanner
      • rusers Show Logged in Users
      • rusers scan whole Subnet
  • Finger Enumeration
    • Finger a Specific Username
    • Solaris bug that shows all logged in users:
  • rwho
• TLS & SSL Testing
  • testssl.sh
• Vulnerability Assessment
• Database Penetration Testing
  • Oracle
    • Fingerprint Oracle TNS Version
    • Brute force oracle user accounts
    • Oracle Privilege Escalation
      • Identify default accounts within oracle db using NMAP NSE scripts:
      • How to identify the current privilege level for an oracle user:
      • Oracle priv esc and obtain DBA access:
      • Run the exploit with a select query:
      • Remove the exploit using:
      • Get Oracle Reverse os-shell:
  • MSSQL
    • Bruteforce MSSQL Login
    • Metasploit MSSQL Shell
• Network
  • Plink.exe Tunnel
  • Pivoting
    • SSH Pivoting
    • Meterpreter Pivoting
  • TTL Finger Printing
  • IPv4 Cheat Sheets
    • Classful IP Ranges
    • IPv4 Private Address Ranges
    • IPv4 Subnet Cheat Sheet
  • VLAN Hopping
  • VPN Pentesting Tools
    • IKEForce
    • IKE Aggressive Mode PSK Cracking
      • Step 1: Idenitfy IKE Servers
      • Step 2: Enumerate group name with IKEForce
      • Step 3: Use ike-scan to capture the PSK hash
      • Step 4: Use psk-crack to crack the PSK hash
    • PPTP Hacking
      • NMAP PPTP Fingerprint:
      • PPTP Dictionary Attack
  • DNS Tunneling
    • Attacking Machine
• BOF / Exploit
• Exploit Research
  • Searching for Exploits
  • Compiling Windows Exploits on Kali
  • Cross Compiling Exploits
  • Exploiting Common Vulnerabilities
    • Exploiting Shellshock
      • cat file (view file contents)
      • Shell Shock run bind shell
      • Shell Shock reverse Shell
• Simple Local Web Servers
• Mounting File Shares
• HTTP / HTTPS Webserver Enumeration
• Packet Inspection
• Username Enumeration
  • SMB User Enumeration
  • SNMP User Enumeration
• Passwords
  • Wordlists
• Brute Forcing Services
  • Hydra FTP Brute Force
  • Hydra POP3 Brute Force
  • Hydra SMTP Brute Force
• Password Cracking
  • John The Ripper - JTR
• Windows Penetration Testing Commands
• Linux Penetration Testing Commands
• Compiling Exploits
  • Identifying if C code is for Windows or Linux
  • Build Exploit GCC
  • GCC Compile 32Bit Exploit on 64Bit Kali
  • Compile Windows .exe on Linux
• SUID Binary
  • SUID C Shell for /bin/bash
  • SUID C Shell for /bin/sh
  • Building the SUID Shell binary
• Reverse Shells
• TTY Shells
  • Python TTY Shell Trick
  • Spawn Interactive sh shell
  • Spawn Perl TTY Shell
  • Spawn Ruby TTY Shell
  • Spawn Lua TTY Shell
  • Spawn TTY Shell from Vi
  • Spawn TTY Shell NMAP
• Metasploit Cheat Sheet
  • Meterpreter Payloads
  • Windows reverse meterpreter payload
  • Windows VNC Meterpreter payload
  • Linux Reverse Meterpreter payload
• Meterpreter Cheat Sheet
• Common Metasploit Modules
  • Remote Windows Metasploit Modules (exploits)
  • Local Windows Metasploit Modules (exploits)
  • Auxilary Metasploit Modules
  • Metasploit Powershell Modules
  • Post Exploit Windows Metasploit Modules
• ASCII Table Cheat Sheet
• CISCO IOS Commands
• Cryptography
  • Hash Lengths
  • Hash Examples
• SQLMap Examples