theHarvester gathers emails, names, subdomains, IPs and URLs from multiple public sources.
Recon
15 cmds
Basic Recon
Use all sources for recon
Google dorking for emails/subdomains
Bing search for emails/subdomains
LinkedIn employee enumeration
Shodan infrastructure intel
Certificate transparency logs
Hunter.io email discovery (API key required)
DNS records via DNSDumpster
Options & Output
Limit to 200 search results
Save results to HTML and XML files
Verbose output
Start at result offset 50
DNS reverse lookup on discovered IPs
DNS brute force with TLD expansion
Perform DNS TLD expansion
IDOR & Broken Access Control
Insecure Direct Object Reference and broken access control — ID tampering, mass assignment, verb abuse, encoded references, BFLA function-level access and Autorize/Arjun tooling.
Web Pentest
19 cmds
Finding IDOR
Increment/decrement object IDs to reach others' data
Tamper an ID in the query string
Compare the self route with a direct-ID route
Fuzz IDs and flag 200 responses
Parameter & Body Tampering
Swap the user id in a JSON body
Mass assignment — add privileged fields the API trusts
Duplicate parameter — some parsers honour the last (or first)
Wrap the id in an array to bypass type checks
HTTP Verb / Method
Write or modify via an unprotected verb
Smuggle a privileged method past verb-based rules
Indirect / Encoded References
Decode, change, then re-encode object references
Change the subject when the API trusts the token id
Guess hashed identifiers derived from sequential values
Collect graph data from Linux (see the BloodHound sheet)
Enumerate AD CS misconfigurations (see the Certipy sheet)
Wireshark & TCPDump — Packet Analysis
Capture and analyze network traffic with Wireshark and TCPDump for credential interception and protocol analysis.
Network Pentest
29 cmds
TCPDump — Capture
Capture all traffic on eth0
Capture on all interfaces
Save capture to PCAP file
Full packet capture (no truncation)
Capture traffic to/from specific host
Capture HTTP traffic only
Capture HTTPS/TLS traffic
Capture FTP/Telnet/POP3 (cleartext creds)
Capture from subnet, no DNS resolve
Print HTTP payload as ASCII
Print hex+ASCII payload for HTTP
Read and analyze saved PCAP file
Wireshark Display Filters
Show only HTTP traffic
Show only HTTP POST requests
Show traffic to/from IP
Show traffic on specific port
Show only SYN packets (new connections)
Find HTTP packets containing "password"
Show cleartext credential protocols
Show only DNS traffic
Show SMB traffic (NTLMv2 hashes)
Find NTLM authentication frames
Exclude noise (ARP, ICMP, DNS)
Show TCP issues (retransmissions, resets)
Wireshark CLI (tshark)
Capture to PCAP via CLI
Extract HTTP request URIs from PCAP
Extract POST data payloads
Extract FTP credentials from capture
Export all HTTP objects (files) from PCAP
Hydra — Online Password Brute Force
Hydra is a fast, parallelized online password cracker supporting 50+ protocols.
Exploitation
22 cmds
SSH, FTP, RDP
SSH brute force single username
SSH brute force user+pass lists
FTP brute force
RDP brute force
RDP with 4 threads (RDP is slow)
SSH on non-standard port 2222
Web Forms (HTTP)
HTTP POST form brute force
HTTP GET form brute force
HTTPS POST form brute force
WordPress wp-login.php brute force
Other Protocols
SMB/Windows shares brute force
MySQL brute force
MSSQL brute force
Telnet brute force
SMTP brute force
POP3 brute force
LDAP brute force
Use colon-separated credential file (user:pass)
Speed & Output
20 tasks, 30s timeout, verbose output
Save found credentials to file
Restore previous interrupted session
Generate passwords: 4-6 chars, lower+upper+digits
Insecure Deserialization
Insecure deserialization across languages — stream fingerprinting, Java ysoserial gadget chains, PHP phpggc + manual objects, Python pickle/PyYAML, .NET ysoserial.net (ViewState/BinaryFormatter), Ruby Marshal and Node node-serialize.
Web Pentest
22 cmds
Detection & Magic Bytes
Java serialized object signature
PHP serialized object / array
Python pickle stream
.NET BinaryFormatter stream
Ruby Marshal data
Java — ysoserial
Detect deserialization with a dependency-free DNS callback
Generate a CommonsCollections RCE gadget
BeanUtils gadget (common on Jenkins / Spring apps)
Spring gadget chain
PHP — phpggc & Manual
List every available PHP gadget chain
Generate a Laravel RCE gadget chain
Monolog gadget, base64 output
Hand-craft an object to hit a __wakeup/__destruct gadget
Trigger object instantiation via the phar:// wrapper
Python — pickle / PyYAML
Build a base64 pickle RCE payload via __reduce__
PyYAML RCE via unsafe load / full_load
PyYAML RCE that returns command output
.NET — ysoserial.net
Generate a BinaryFormatter RCE payload
Forge a malicious ASP.NET ViewState (leaked machineKey)
Abuse polymorphic type handling in Json.NET
Ruby / Node
Ruby 2.x–3.x universal deserialization RCE gadget
node-serialize RCE via an IIFE function
Coercion & mitm6 — Forced Authentication
Force machine accounts to authenticate to you and relay it — PetitPotam, PrinterBug, DFSCoerce, ShadowCoerce, Coercer and mitm6, paired with ntlmrelayx / Certipy relay (RBCD, Shadow Credentials, ESC8).
Active Directory
20 cmds
mitm6 — IPv6 DNS Takeover
Spoof DHCPv6 to become the network's IPv6 DNS server (WPAD/auth capture)
Only answer FQDN queries for the target domain — quieter, less breakage
Restrict spoofing to a single victim host (targeted)
Relay the IPv6/WPAD-captured machine auth to LDAPS → configure RBCD
Relay → add a new computer account (then use it for RBCD)
PetitPotam — MS-EFSRPC
Unauthenticated EFSRPC coercion (unpatched DCs) — listener then target
Abuse the Print Spooler RPC to coerce the target to auth to your listener
Alternative SpoolSample/PrinterBug trigger
Check whether the MS-RPRN (Spooler) interface is exposed first
DFSCoerce / ShadowCoerce
MS-DFSNM coercion — works even when the Spooler is disabled
MS-FSRVP (VSS) coercion — another no-Spooler path
Coercer — All-in-One
Enumerate which coercion methods/pipes the target actually exposes
Fire every available coercion method at the target at once
Trigger one specific RPC method only
Relay Combos (where the coerced auth goes)
Relay coerced machine auth to LDAPS → grant RBCD over the victim computer
Relay → add Shadow Credentials (msDS-KeyCredentialLink) on the DC
ESC8 — relay coerced DC$ auth to AD CS web enrollment to mint a DC cert
Relay to SMB and stash the session in a SOCKS proxy for reuse
API Security — OWASP API Top 10
REST API penetration testing mapped to the OWASP API Security Top 10 — endpoint/spec discovery, BOLA/BFLA, broken auth, mass assignment & data exposure, resource consumption, SSRF, CORS/misconfig, shadow versions and tooling.
Web Pentest
25 cmds
Recon & Discovery
Hunt API docs that map the entire attack surface
Brute API routes — 401/403 still reveal hidden endpoints
Kiterunner — content discovery tuned for API routes
Crawl and extract API endpoints from JavaScript
Version & shadow-API discovery (API9)
API1 / API5 — BOLA & BFLA
API1 BOLA — read/modify others' objects by changing IDs
API5 BFLA — invoke admin-only functions
Automate authorization testing across the whole API
API2 — Broken Authentication
API2 — brute/stuff when login isn't throttled
Brute the login endpoint
Token and key weaknesses
Account takeover via a weak reset flow
API3 — Mass Assignment & Data Exposure
API3 BOPLA — inject privileged fields the API binds blindly
Excessive data exposure — the server over-returns
Object property-level authorization bypass
API4 — Resource Consumption
API4 — melt the DB/memory with huge page sizes
Cost & DoS via unbounded operations
Parser resource exhaustion
API7 / API8 / API9 — SSRF, Misconfig, Inventory
API7 SSRF via URL-accepting fields
API8 — permissive CORS leaking authenticated data
API8 misconfiguration probes
API9 — deprecated/shadow versions skip new controls
Tooling
Automated API misconfig/exposure checks
Discover hidden JSON parameters
Build the request corpus to fuzz
Certipy — AD CS Abuse (ESC1–ESC16)
Active Directory Certificate Services enumeration and abuse with Certipy v5 — ESC1 through ESC16, NTLM relay to AD CS (ESC8/ESC11), shadow credentials, and golden certificates.
Active Directory
36 cmds
Enumeration & Discovery
Enumerate CAs, templates and ACLs — dumps JSON/TXT report
Show only vulnerable templates (ESC findings) on stdout
Only enabled AND vulnerable templates (real attack surface)
Pass-the-hash enum + BloodHound output for graphing
Force both text and JSON output of the AD CS layout
ESC1 — SAN Impersonation
Request a cert for the template, supplying Administrator UPN in the SAN
Add both UPN and DNS SAN (impersonate a machine/DC)
Embed target SID (required when StrongCertificateBindingEnforcement is on)
ESC2 / ESC3 — Any-Purpose & Enrollment Agent
ESC2 — Any-Purpose EKU template: request, then auth as anyone
AWS IMDSv2 — PUT here first to get a session token
GCP token (needs header Metadata-Flavor: Google)
Azure IMDS (needs header Metadata: true)
IP Encoding Bypass
127.0.0.1 as a decimal integer
127.0.0.1 in hexadecimal
127.0.0.1 in octal
Short-form loopback
IPv4-mapped IPv6 address
Public DNS name that resolves to 127.0.0.1
Parser Confusion & Redirect
Everything before @ is userinfo; real host is 127.0.0.1
Fragment confuses naive host parsers
Backslash parser inconsistency
Open redirect to bypass allow-lists
Suffix trick against weak allow-list checks
Protocol Smuggling
Read local files when file:// is permitted
Leak process environment (secrets) on Linux
Talk to Memcached via dict://
Smuggle a Redis command via gopher (RCE primitives)
Smuggle SMTP via gopher
Blind SSRF & Parser-Driven
OOB interaction (interactsh / Burp Collaborator) for blind SSRF
Hit your own listener to confirm an outbound request
SVG→PDF/PNG renderer SSRF
XXE-driven SSRF via an external entity
XXE — XML External Entity
XML External Entity attacks — local file read, SSRF, PHP filter/expect wrappers, blind & error-based out-of-band exfiltration via external DTDs, XInclude, SVG/Office documents and entity-expansion DoS.
Web Pentest
15 cmds
Basic File Read
Read a local file via an external entity
Windows local file read
Directory listing on some Java parsers
SSRF via XXE
Reach cloud metadata through XXE
Hit an internal-only service
PHP Wrappers
Base64-wrap to read files with special chars (PHP)
Read application PHP source code
Command exec if the PHP expect wrapper is enabled
Blind / Out-of-Band
Load an external DTD for out-of-band exfil
External DTD that exfiltrates a file over HTTP
Leak file contents inside a parser error message
Other Vectors
XInclude — works when you cannot control the DOCTYPE
XXE through an uploaded SVG
XXE via Office Open XML documents
Billion Laughs entity-expansion DoS
SearchSploit & ExploitDB — Exploit Discovery
SearchSploit — local ExploitDB search tool for finding and using publicly known exploits.
Exploitation
14 cmds
Searching
Search exploits for Apache 2.4
Search WordPress 5.0 exploits
Search OpenSSH exploits
Search by exploit title only
Search by CVE number (Log4Shell)
Show URL to web version of exploit
Update ExploitDB database
Viewing & Using Exploits
View/examine exploit file
Copy exploit to current directory
Copy exploit by ID
Show full path of exploit
Browse ExploitDB directory structure
Nmap Integration
Search exploits matching Nmap XML scan results
Scan then auto-search exploits for found services
Burp Suite — Web Application Testing Proxy
Burp Suite CLI tools and key workflows for web application security testing.
Web Pentest
27 cmds
Burp CLI & Startup
Start Burp Suite Community
Start Burp Pro with 2GB heap
Open existing project file
Load configuration from file
Proxy & Intercept
Send curl request through Burp proxy
HTTPS request through Burp (skip cert check)
Set Burp as system proxy for all tools
Route Python script through Burp
Intruder Attack Types
One position, one wordlist (username enum, fuzzing)
Same payload everywhere (user=FUZZ&pass=FUZZ)
Paired lists (user list + password list, row by row)
Full combo attack (every user x every password)
Repeater & Decoder
Send intercepted request to Repeater for manual testing
Send to Intruder for automated attack
URL decode in Decoder or Repeater
Base64 encode in Decoder
Scanner & Active Scan (Pro)
Run active scan via Burp Pro CLI
Launch active scan on specific request
Crawl + audit full target
Useful Extensions (BApp Store)
Better request logging with filtering
Replay requests with lower-privilege tokens
JWT manipulation and algorithm confusion
Find hidden GET/POST/header params
Additional vulnerability checks for Pro Scanner
Automated CORS vulnerability testing
Dynamic payload transforms inline in Repeater
Automated file upload exploitation
GraphQL Attacks
GraphQL security testing — endpoint discovery and engine fingerprinting, introspection (and recovery when disabled), IDOR/authz via nodes & mutations, batching rate-limit bypass, DoS and injection.
Web Pentest
17 cmds
Discovery
Confirm a GraphQL endpoint
Hunt the endpoint + any exposed IDE
Fingerprint the GraphQL engine
Introspection
Full introspection — dump the schema
List all queries and mutations
Inspect a specific type's fields
Recover the schema even when introspection is disabled
Authz / IDOR
IDOR via a node argument
Authz bypass / mass assignment via a mutation
Relay global-id IDOR (base64 of type:id)
Rate-Limit Bypass (Batching)
Alias many attempts in ONE request to beat rate limits
Array/JSON batching — send many operations at once
DoS
Deeply nested / circular query to exhaust resources
Hand-built SQL injection payloads — auth bypass, UNION extraction, schema enum, error/blind/time-based, stacked-query RCE and WAF bypasses across MySQL, MSSQL, PostgreSQL and Oracle.
Web Pentest
38 cmds
Detection & Auth Bypass
Classic always-true authentication bypass
Comment out the rest of the query
Log in as a known user, comment the password check
Break out of a double-quote + parenthesis context
MySQL hash-comment variant
URL-friendly always-true
UNION-Based Extraction
Find the column count (increment until it errors)
Match the column count with NULLs
Identify which columns are reflected
Leak DB version (MySQL/MSSQL)
Dump credentials
Concatenate all creds into one row (MySQL)
Schema Enumeration
List all tables
List columns of a table
List databases (MySQL)
Oracle version banner
List tables (PostgreSQL)
Error-Based
MySQL error-based leak (extractvalue)
MySQL error-based leak (updatexml)
MSSQL error-based type-cast leak
PostgreSQL error-based cast leak
Blind — Boolean & Time
Boolean TRUE baseline
Boolean FALSE baseline (diff the responses)
Extract data one character at a time
MySQL time-based delay
MySQL conditional time delay
MSSQL time-based delay
PostgreSQL time-based delay
Stacked Queries & RCE
Enable xp_cmdshell on MSSQL
Run an OS command via MSSQL
PostgreSQL command exec via COPY TO PROGRAM
MySQL write a webshell (needs FILE priv + writable path)
WAF / Filter Bypass
MySQL versioned-comment keyword bypass
Mixed-case keyword bypass
Inline comments instead of spaces
Tab (%09) used as whitespace
ALL keyword to dodge "UNION SELECT" signatures
Double URL-encoded ' OR 1=1
Nikto — Web Vulnerability Scanner
Nikto web server scanner — checks for dangerous files, outdated software, and server misconfigurations.
Web Pentest
18 cmds
Basic Scanning
Basic scan against target
Scan multiple ports
Force SSL/HTTPS scanning
Full tuning (all checks)
Interesting file/seen in logs only
Misconfiguration checks
XSS checks
Command injection checks
Authentication & Proxy
HTTP Basic Auth credentials
Route through Burp proxy
Include session cookie
Output & Evasion
Save output as HTML report
Save as CSV
Save as XML
IDS evasion: random URI encoding
IDS evasion: directory self-reference /./
IDS evasion: Windows directory separator
Add 1 second delay between requests
Race Conditions
Race-condition exploitation — limit-overrun targets, Burp single-packet attack, Turbo Intruder gating, parallel curl/GNU-parallel bursts, plus how to confirm and mitigate (idempotency, locks).
Web Pentest
12 cmds
Targets (Limit Overrun)
Use a one-time resource multiple times via concurrency
Double-spend before the balance updates
Beat uniqueness checks with parallel requests
Burp — Single-Packet Attack
Fire all requests together (single-packet attack, HTTP/2)
Last-byte sync to minimise network jitter
Turbo Intruder
Queue N requests behind a gate
Release all gated requests at the same instant
Use the bundled single-packet race template
curl / parallel
Fire 30 parallel requests with xargs
GNU parallel burst
Confirm & Mitigate
How to confirm a successful race
Defensive notes
Command Injection
OS command injection — separators and substitution, blind/time-based detection, OOB exfiltration, space/keyword/WAF bypasses, reverse shells and Windows command injection.
Web Pentest
29 cmds
Separators
Chain a second command (semicolon)
Pipe into the injected command
Run only if the first command fails
Background separator (also Windows)
Run if the first command succeeds
Backtick command substitution
Modern command substitution
URL-encoded newline as a separator
Blind / Time-Based
Confirm blind injection via a delay (Unix)
Time delay via substitution
Unix delay via ping
Windows delay via ping
Out-of-Band Exfil
Exfil command output via an HTTP callback
DNS exfil of command output
POST a file to your listener
Base64 the output to survive URL/DNS rules
Space & Keyword Bypass
${IFS} substitutes for a blocked space
Brace expansion avoids spaces
Input redirection instead of a space
Empty quotes break keyword matching
Glob wildcards avoid literal binary names
Base64-decode then execute
Reverse Shells
Bash reverse shell
Netcat reverse shell
Netcat (no -e) FIFO reverse shell
Windows
Windows command separator
Download + execute a payload (certutil)
Run an encoded PowerShell command
PowerShell download-cradle
Pivoting & Tunneling
Pivot into internal networks — Ligolo-ng, Chisel, SSH local/remote/dynamic forwards & ProxyJump, proxychains, Metasploit autoroute/socks, socat/netcat relays and native Windows netsh/plink forwarding.
Network Pentest
25 cmds
Ligolo-ng
Start the Ligolo-ng proxy on your attack box
Run the agent on the pivot (Linux or agent.exe)
Route the internal subnet through the ligolo interface
Pick the agent session and start the tunnel
Reverse port-forward to catch shells from internal hosts
Chisel
Start the Chisel server (reverse mode) on the attacker
Reverse SOCKS proxy from the pivot back to you
Reverse single-port forward (e.g. RDP)
Local forward to an internal host through the pivot
SSH Tunneling
Dynamic SOCKS proxy through SSH
Local port forward to an internal service
Reverse forward — expose a pivot-local service to you
ProxyJump straight to an internal host
proxychains (use the SOCKS)
Point proxychains at your SOCKS tunnel
TCP-connect scan through the proxy (no SYN over SOCKS)
Run AD tooling across the internal subnet
RDP through the tunnel
Metasploit / Meterpreter
Add a Meterpreter route to the internal subnet
Forward an internal port to your localhost
Expose the routes as a SOCKS proxy for proxychains
socat / netcat Relays
Simple TCP relay through a Linux pivot
Netcat relay without -e
Windows-Side Forwarding
Native Windows port forward — nothing to upload
SSH reverse tunnel from Windows (plink)
Run the Chisel client on Windows
WPScan — WordPress Security Scanner
WPScan is a WordPress security scanner for finding vulnerabilities, weak passwords, and exposed files.