WPScan is a WordPress security scanner for finding vulnerabilities, weak passwords, and exposed files.
Web Pentest
19 cmds
Basic Scanning
Basic WordPress scan
Full enumeration (plugins, themes, users)
Enumerate users only
Enumerate plugins only
Enumerate themes only
Enumerate only vulnerable plugins
Enumerate only vulnerable themes
Enumerate ALL plugins (aggressive, slow)
Password Attacks
Brute force admin password
Brute force multiple users
Enumerate users then brute force
Brute force with 20 threads
Advanced Options
Use WPScan API token for vuln data
Route through Burp proxy
Aggressive detection (more requests)
Save output as JSON report
Bypass HTTP basic auth
Scan as authenticated user
Randomize User-Agent per request
Frida — Dynamic Instrumentation & Hooking
Frida dynamic instrumentation toolkit for hooking, bypassing, and analyzing mobile and desktop apps.
Mobile Pentest
24 cmds
Setup & Connection
Install Frida CLI tools
List connected devices
List processes on USB device
List processes on remote device
Start frida-server on device (run on device via adb shell)
Deploy and start frida-server on Android
Attach & Spawn
Attach to running app with script (USB)
Spawn (launch) app with script from start
Attach via remote Frida server
Attach interactively (REPL mode)
Trace all calls to open() function
Trace iOS NSURLSession network calls
Common Hook Scripts
Bypass SSL pinning (Conscrypt TrustManager)
Bypass root detection — override isRooted()
Hook Android Activity lifecycle
Hook native libc open() calls
Hook crypto function and log decrypted output
objection (Frida wrapper)
Launch objection REPL against app
Disable SSL pinning (inside objection)
Bypass root detection (inside objection)
List all loaded classes
List methods of a class
Hook all methods in a class
Dump app memory
Hydra — Online Password Brute Force
Hydra is a fast, parallelized online password cracker supporting 50+ protocols.
Exploitation
22 cmds
SSH, FTP, RDP
SSH brute force single username
SSH brute force user+pass lists
FTP brute force
RDP brute force
RDP with 4 threads (RDP is slow)
SSH on non-standard port 2222
Web Forms (HTTP)
HTTP POST form brute force
HTTP GET form brute force
HTTPS POST form brute force
WordPress wp-login.php brute force
Other Protocols
SMB/Windows shares brute force
MySQL brute force
MSSQL brute force
Telnet brute force
SMTP brute force
POP3 brute force
LDAP brute force
Use colon-separated credential file (user:pass)
Speed & Output
20 tasks, 30s timeout, verbose output
Save found credentials to file
Restore previous interrupted session
Generate passwords: 4-6 chars, lower+upper+digits
Hashcat — Offline Password Cracking
Hashcat is the world's fastest password recovery tool supporting 300+ hash types and GPU acceleration.
Exploitation
32 cmds
Hash Identification & Modes
Auto-identify hash type
Identify hash with hashid tool
MD5 crack with wordlist
SHA1 crack
SHA256 crack
SHA512crypt ($6$) — Linux shadow
MD5crypt ($1$) — Linux shadow
NTLM hash (Windows)
NetNTLMv2 (Responder captures)
Kerberoast TGS hash ($krb5tgs$23$)
AS-REP Roast ($krb5asrep$23$)
bcrypt ($2*$) — common web apps
IPMI2 RAKP HMAC-SHA1
RSA/DSA/EC/OpenSSH private key
Attack Modes
Dictionary attack (-a 0)
Combination attack: combine two wordlists (-a 1)
Brute force 6-char all charset (-a 3)
Hybrid: wordlist + mask suffix (-a 6)
Hybrid: mask prefix + wordlist (-a 7)
Dictionary + best64 rules
Dictionary + OneRuleToRuleThemAll
Mask Attack (Brute Force)
Hashcat mask character reference
Mask: 1 upper + 4 lower + 3 digits
Incremental mask attack 4-8 chars
Custom charset: lowercase + digits, 8 chars
Performance & GPU
Workload profile 3 (high performance)
Force run (ignore warnings, useful in VMs)
Use GPU device 1 only
Show status every 10 seconds
Disable potfile (crack same hash again)
Show already-cracked hashes from potfile
Benchmark NTLM cracking speed
Subfinder & Amass — Subdomain Enumeration
Passive and active subdomain enumeration with Subfinder and Amass.
Recon
21 cmds
Subfinder
Basic subdomain enumeration
Save results to file
Verbose mode — show source of each subdomain
Use all sources (slower but more results)
Recursive subdomain enumeration
Enumerate subdomains for multiple domains
Custom threads and timeout
Use API keys config file
Amass Enum
Basic passive enumeration
Active enumeration (DNS brute force + passive)
Save output to file
DNS brute force with wordlist
Show source + IP for each subdomain
Limit DNS queries per second
WHOIS-based org/ASN intel gathering
Enumerate domains owned by ASN
Post-Processing & Chaining
Find live HTTP hosts from subdomains
Get title, tech stack, status for each subdomain
Resolve subdomains to IPs with dnsx
Deduplicate subdomain list
Combine Amass + Subfinder results
Windows Privilege Escalation
Manual Windows privilege escalation — enumeration, token/Potato attacks (PrintSpoofer/GodPotato), service misconfigurations, AlwaysInstallElevated, credential hunting, UAC bypasses, kernel exploits and scheduled-task/autorun hijacks.
Privilege Escalation
27 cmds
Enumeration
Groups + privileges + integrity level in one shot
List token privileges (look for SeImpersonate/SeBackup/SeDebug)
OS build + installed patches (feed to wesng/watson)
Local users and who is admin
PowerUp automated misconfig checks
Token Privileges (Potato)
SeImpersonate → SYSTEM via the spooler named pipe
Modern SeImpersonate→SYSTEM (DCOM/RPC)
SeImpersonate→SYSTEM on older builds
Dump SAM/SYSTEM with backup rights
Service Misconfigurations
Find unquoted service paths
Find services your user can modify
Hijack a weak-permission service binPath
DLL/binary hijack of a service
Registry & AlwaysInstallElevated
If 1 (both hives) → install a SYSTEM MSI
Run the malicious MSI (AlwaysInstallElevated)
Autologon credentials in the registry
Credential Hunting
Reuse stored credentials without knowing them
Grep the filesystem for passwords
Deployment files often hold local-admin creds
MS14-025 — decryptable domain creds
UAC Bypass & Kernel
Elevate from a medium-integrity admin without a prompt
Alternate auto-elevate bypasses
Map missing patches to kernel exploits
Spooler RCE/LPE
Scheduled Tasks & Autoruns
Find tasks running as a higher-priv user
Hijack a scheduled-task executable
Enumerate all autostart entries (Sysinternals)
IDOR & Broken Access Control
Insecure Direct Object Reference and broken access control — ID tampering, mass assignment, verb abuse, encoded references, BFLA function-level access and Autorize/Arjun tooling.
Web Pentest
19 cmds
Finding IDOR
Increment/decrement object IDs to reach others' data
Tamper an ID in the query string
Compare the self route with a direct-ID route
Fuzz IDs and flag 200 responses
Parameter & Body Tampering
Swap the user id in a JSON body
Mass assignment — add privileged fields the API trusts
Duplicate parameter — some parsers honour the last (or first)
Wrap the id in an array to bypass type checks
HTTP Verb / Method
Write or modify via an unprotected verb
Smuggle a privileged method past verb-based rules
Indirect / Encoded References
Decode, change, then re-encode object references
Change the subject when the API trusts the token id
Guess hashed identifiers derived from sequential values
Auto-compare low-priv vs high-priv responses on every request
Discover hidden parameters that may be IDOR-able
John the Ripper — Password Cracking
John the Ripper — versatile password cracker with hash extraction helpers for common file formats.
Exploitation
23 cmds
Basic Cracking
Auto-detect hash and crack with default wordlist
Dictionary attack with rockyou
Dictionary + mangling rules
Crack NTLM hashes specifically
Crack Linux SHA512crypt shadow hashes
Crack bcrypt hashes
Show cracked passwords
List all supported hash formats
Hash Extraction Tools (John suite)
Combine passwd+shadow for cracking
Crack password-protected ZIP
Crack password-protected RAR
Crack PDF password
Crack SSH private key passphrase
Crack Office document password
Crack KeePass database
Crack 7-Zip archive password
Advanced Options
Brute force with incremental mode
Brute force digits only
Mask attack pattern
Use 4 CPU cores in parallel
Custom pot file path
Resume interrupted session
Name the cracking session
MSFVenom — Payload Generation
MSFVenom combines msfpayload and msfencode for generating custom shellcode and payloads.
Exploitation
24 cmds
Windows Payloads
64-bit Windows Meterpreter EXE
32-bit Windows Meterpreter EXE
Windows DLL payload
PowerShell payload
HTTPS reverse shell (evades inspection)
Plain Windows reverse shell (no Meterpreter)
Linux Payloads
64-bit Linux Meterpreter ELF
32-bit Linux plain shell ELF
Linux reverse shell + make executable
Web Payloads
PHP Meterpreter webshell
JSP reverse shell (Tomcat/JBoss)
WAR file for Java servers
ASPX webshell for IIS
Python Meterpreter payload
Android & macOS
Android APK Meterpreter payload
macOS Meterpreter payload
Encoders & Evasion
List all available encoders
XOR encode payload 10 times
Double encode via pipe
Inject payload into legitimate binary
Generate smallest possible payload
Multi/Handler Listener
Set up payload listener in msfconsole
Set matching payload for handler
Start listener as background job
Certipy — AD CS Abuse (ESC1–ESC16)
Active Directory Certificate Services enumeration and abuse with Certipy v5 — ESC1 through ESC16, NTLM relay to AD CS (ESC8/ESC11), shadow credentials, and golden certificates.
Active Directory
36 cmds
Enumeration & Discovery
Enumerate CAs, templates and ACLs — dumps JSON/TXT report
Show only vulnerable templates (ESC findings) on stdout
Only enabled AND vulnerable templates (real attack surface)
Pass-the-hash enum + BloodHound output for graphing
Force both text and JSON output of the AD CS layout
ESC1 — SAN Impersonation
Request a cert for the template, supplying Administrator UPN in the SAN
Add both UPN and DNS SAN (impersonate a machine/DC)
Embed target SID (required when StrongCertificateBindingEnforcement is on)
ESC2 / ESC3 — Any-Purpose & Enrollment Agent
ESC2 — Any-Purpose EKU template: request, then auth as anyone
Read LAPS local-admin passwords (where authorized)
DCSync-style NTDS dump over DRSUAPI
Dump LSASS via nanodump (more EDR-evasive)
Recover cPassword from SYSVOL GPP (MS14-025)
LDAP & Other Protocols
AS-REP Roasting via LDAP
Kerberoasting via LDAP
Collect BloodHound data via LDAP
Dump gMSA passwords
MSSQL query execution
MSSQL with local auth
SSH command execution
Test RDP credentials on subnet
Read LAPS passwords over LDAP
Find unconstrained-delegation accounts
Accounts with PASSWD_NOTREQD set
Enumerate AD CS certificate authorities
Dump user descriptions (often contain passwords)
Sweep hosts for WinRM (evil-winrm) access
Modules & Spidering
Spider every readable share and index files (JSON output)
Spider a specific share for a keyword
Find autologon credentials in Group Policy
Enumerate installed AV / EDR products
Read the domain MachineAccountQuota
List all available NetExec modules for a protocol
Nmap — Network Scanning & Enumeration
Complete Nmap reference for host discovery, port scanning, service detection, and NSE scripting.
Network Pentest
46 cmds
Host Discovery
Ping sweep — discover live hosts (no port scan)
TCP SYN ping on specific ports
TCP ACK ping sweep
UDP ping sweep
ARP ping (local network)
Ping sweep from target list file
Port Scanning
Scan all 65535 ports
Scan specific ports
Scan port range
Fast scan — top 100 ports
Scan top 1000 most common ports
SYN (stealth) scan — requires root
TCP connect scan (no root needed)
UDP scan common ports
ACK scan — map firewall rules
Service & Version Detection
Service/version detection
Aggressive version detection
OS detection
Aggressive scan: OS+version+scripts+traceroute
Version + default NSE scripts
NSE Scripts
Run default scripts
Get HTTP page titles
Run all vulnerability scripts
Check EternalBlue (MS17-010)
SMB enumeration
Check FTP anonymous login
SSH authentication methods
DNS zone transfer attempt
Enumerate web directories
Check Heartbleed vulnerability
MySQL enumeration
MSSQL enumeration
Output & Timing
Save normal output to file
Save XML output
Greppable output
Save all formats (normal+xml+grep)
T4 timing (faster, less stealthy)
T1 timing (very slow, stealthy)
Set minimum packet rate for speed
Evasion & Firewall Bypass
Fragment packets to evade IDS
Decoy scan with 10 random IPs
Decoy scan with specific IPs
Spoof source port (bypass firewall rules)
Append random data to packets
Randomize target scan order
Scan through SOCKS proxy/Tor
Netcat & Socat — Network Swiss Army Knife
Netcat and Socat for reverse shells, port forwarding, file transfer, and network debugging.
Exploitation
27 cmds
Netcat Listeners & Connect
Start listener on port 4444
Connect to remote host:port
Bind shell on Linux (listen)
Reverse shell to attacker (Linux)
Reverse shell to attacker (Windows)
Reverse Shells (One-liners)
Bash TCP reverse shell
Bash reverse shell (command injection safe)
Python3 reverse shell
PHP reverse shell
Perl reverse shell
Ruby reverse shell
PowerShell reverse shell
Shell Stabilisation (TTY)
Upgrade to PTY shell with Python
Full TTY upgrade (raw mode)
Upgrade shell using script command
Alternative shell upgrade with script
Set terminal size in upgraded shell
Socat
Socat bind shell listener
Socat reverse shell to attacker
Socat fully stable PTY listener
Socat PTY reverse shell (no upgrade needed)
Port forward: localhost:8080 → target:80
Debug mode — verbose output
File Transfer
Receive file via netcat (attacker)
Send file via netcat (victim)
Socat file receive
Socat file send
Responder — LLMNR/NBT-NS Poisoning
Responder poisons LLMNR, NBT-NS, and mDNS to capture NTLMv2 hashes from Windows hosts on the local network.
Active Directory
14 cmds
Basic Usage
Start Responder with rogue DHCP, DNS, WPAD, verbose
Analyze mode only — passive, no poisoning
Default mode — LLMNR + NBT-NS poison
Enable ProxyAuth (WPAD credential capture)
Fingerprint hosts before poisoning
Cracking Captured Hashes
View captured NTLMv2 hashes
Crack NTLMv2 hashes with Hashcat
Crack NTLMv2 with John
Relay Attacks (with ntlmrelayx)
Downgrade to NTLMv1 (for relay)
Relay captured hashes to target list
Relay + create admin user
Disable Responder SMB/HTTP servers for relay to work
MultiRelay & WPAD
MultiRelay attack against specific target
WPAD + ProxyAuth captures plaintext creds from IE/Chrome
API Security — OWASP API Top 10
REST API penetration testing mapped to the OWASP API Security Top 10 — endpoint/spec discovery, BOLA/BFLA, broken auth, mass assignment & data exposure, resource consumption, SSRF, CORS/misconfig, shadow versions and tooling.
Web Pentest
25 cmds
Recon & Discovery
Hunt API docs that map the entire attack surface
Brute API routes — 401/403 still reveal hidden endpoints
Kiterunner — content discovery tuned for API routes
Crawl and extract API endpoints from JavaScript
Version & shadow-API discovery (API9)
API1 / API5 — BOLA & BFLA
API1 BOLA — read/modify others' objects by changing IDs
API5 BFLA — invoke admin-only functions
Automate authorization testing across the whole API
API2 — Broken Authentication
API2 — brute/stuff when login isn't throttled
Brute the login endpoint
Token and key weaknesses
Account takeover via a weak reset flow
API3 — Mass Assignment & Data Exposure
API3 BOPLA — inject privileged fields the API binds blindly
Excessive data exposure — the server over-returns
Object property-level authorization bypass
API4 — Resource Consumption
API4 — melt the DB/memory with huge page sizes
Cost & DoS via unbounded operations
Parser resource exhaustion
API7 / API8 / API9 — SSRF, Misconfig, Inventory
API7 SSRF via URL-accepting fields
API8 — permissive CORS leaking authenticated data
API8 misconfiguration probes
API9 — deprecated/shadow versions skip new controls
Tooling
Automated API misconfig/exposure checks
Discover hidden JSON parameters
Build the request corpus to fuzz
BloodHound — Active Directory Attack Path Analysis
BloodHound maps Active Directory attack paths using graph theory to find privilege escalation routes.
Active Directory
19 cmds
Data Collection (SharpHound / BloodHound.py)
Python collector — collect all data
Collect and auto-zip for import
Collect DC info only (faster, stealthier)
Use TCP DNS with custom resolver
SharpHound Windows binary — collect all
SharpHound collect + zip output
Session loop collection for 2 hours
BloodHound collection via NetExec
BloodHound Cypher Queries (Neo4j)
Find all DA/admin users
Shortest path to Domain Admins from any user
Shortest path from specific user to DA
Find all Kerberoastable users
Find AS-REP Roastable users
Find computers with unconstrained delegation
Find enabled users not logged in 90+ days
Find all admin groups
Setup & Launch
Start Neo4j then BloodHound GUI
Start Neo4j in foreground
Install bloodhound-python collector
theHarvester — OSINT Email & Domain Recon
theHarvester gathers emails, names, subdomains, IPs and URLs from multiple public sources.
Recon
15 cmds
Basic Recon
Use all sources for recon
Google dorking for emails/subdomains
Bing search for emails/subdomains
LinkedIn employee enumeration
Shodan infrastructure intel
Certificate transparency logs
Hunter.io email discovery (API key required)
DNS records via DNSDumpster
Options & Output
Limit to 200 search results
Save results to HTML and XML files
Verbose output
Start at result offset 50
DNS reverse lookup on discovered IPs
DNS brute force with TLD expansion
Perform DNS TLD expansion
Gobuster — Directory & DNS Brute Force
Gobuster — fast brute-forcing tool for directories, DNS subdomains, virtual hosts, and S3 buckets.
Web Pentest
19 cmds
Directory/File Mode (dir)
Basic directory brute force
Brute force with file extensions
Only show specific status codes
Blacklist (ignore) status codes
50 threads, quiet mode
Skip TLS/SSL certificate verification
Include cookies in requests
Custom header (Bearer token)
Save results to file
Proxy through Burp Suite
DNS Subdomain Mode (dns)
DNS subdomain enumeration
Fast DNS enum with output
Show CNAME records (useful for takeover)
Use custom DNS resolver
VHost Mode (vhost)
Virtual host brute force
Append domain to wordlist entries
Exclude responses of specific length
S3 & Fuzzing Mode
Brute force S3 bucket names
Generic fuzzing mode
Kerbrute & Rubeus — Kerberos Attacks
Kerbrute for username enumeration and password spraying; Rubeus for full Kerberos attack toolkit.
Active Directory
22 cmds
Kerbrute
Enumerate valid usernames via Kerberos pre-auth
Password spray single password against user list
Brute force specific user
Save valid users to file
Spray with 1-second delay (avoid lockout)
Rubeus — Kerberoasting & AS-REP Roasting
Kerberoast all SPNs in domain
Kerberoast specific service account
Kerberoast with RC4 only (opsec-safe)
AS-REP Roast all users without pre-auth
AS-REP Roast in hashcat format
Rubeus — Ticket Attacks
Dump Kerberos tickets from memory (LUID)
Dump TGT tickets
Pass-the-Ticket — inject .kirbi ticket
Pass-the-Ticket from base64 ticket
S4U2Proxy — constrained delegation abuse
Create Golden Ticket
Create Silver Ticket
Harvest TGTs every 30 seconds
Cracking Kerberos Hashes
Crack Kerberoast TGS hashes (RC4)
Crack Kerberoast TGS hashes (AES128)
Crack AS-REP Roast hashes
Crack Kerberoast with John
Metasploit Framework — Exploitation
Metasploit Framework — the world's most used penetration testing framework for exploit development and execution.
Exploitation
48 cmds
msfconsole Basics
Launch Metasploit console
Launch quietly (no banner)
Initialize database then launch
Search for Windows SMB exploits
Search by CVE number
Select EternalBlue exploit
Show info about selected module
Show required options for module
List compatible payloads
Set target host
Set attacker IP (for reverse shells)
Set listener port
Set Meterpreter payload
Execute the exploit
Check if target is vulnerable (non-intrusive)
Meterpreter Commands
Get system information
Get current user
Get current process ID
List running processes
Migrate to process ID 1234
Drop to OS shell
Upload file to target
Download file from target
Dump local NTLM password hashes
Attempt privilege escalation to SYSTEM
Smart hashdump post module
Find local privilege escalation exploits
Background current session
List all active sessions
Interact with session 1
Start/dump keylogger
Live screen sharing from target
Port forward RDP through Meterpreter
Enable RDP on Windows target
Auxiliary Modules
TCP port scanner
Scan for EternalBlue vulnerability
SSH brute force login
HTTP directory scanner
Find VNC with no auth required
FTP brute force
Capture NTLM hashes over HTTP
Post-Exploitation & Persistence
Collect all credentials on Windows
Collect environment variables
Add persistence via scheduled task
Load Mimikatz (kiwi) extension
Dump all credentials via kiwi
Dump SAM database via kiwi
Dump LSA secrets via kiwi
GitLeaks & Source Code Recon — Secret Discovery
Gitleaks and other tools for finding secrets, credentials, and sensitive data in source code and git history.
Recon
25 cmds
Gitleaks
Scan current git repo for secrets
Scan specific git repository
Scan and save report as JSON
Scan directory without git history
Scan entire git history for secrets
Use custom config/rules file
Git History Recon
List all commits in history
Search all diffs for "password"
Search diffs for common secret patterns
View file at a specific commit
Check stashed changes for secrets
Find commits that touched sensitive file types
Find deleted files in history
truffleHog & Other Tools
truffleHog scan local git repo
truffleHog scan GitHub repo
truffleHog scan filesystem
Find private keys in source code
Find AWS access keys
Find sensitive files by name
Find config files containing secrets
GitHub Dorking (Online)
GitHub search: secrets in org Python files
GitHub: find .env files in org
GitHub: find PEM certificate files
GitHub: find exposed private keys
Google dork: AWS keys on GitHub for org
SearchSploit & ExploitDB — Exploit Discovery
SearchSploit — local ExploitDB search tool for finding and using publicly known exploits.
Exploitation
14 cmds
Searching
Search exploits for Apache 2.4
Search WordPress 5.0 exploits
Search OpenSSH exploits
Search by exploit title only
Search by CVE number (Log4Shell)
Show URL to web version of exploit
Update ExploitDB database
Viewing & Using Exploits
View/examine exploit file
Copy exploit to current directory
Copy exploit by ID
Show full path of exploit
Browse ExploitDB directory structure
Nmap Integration
Search exploits matching Nmap XML scan results
Scan then auto-search exploits for found services
Nikto — Web Vulnerability Scanner
Nikto web server scanner — checks for dangerous files, outdated software, and server misconfigurations.
Web Pentest
18 cmds
Basic Scanning
Basic scan against target
Scan multiple ports
Force SSL/HTTPS scanning
Full tuning (all checks)
Interesting file/seen in logs only
Misconfiguration checks
XSS checks
Command injection checks
Authentication & Proxy
HTTP Basic Auth credentials
Route through Burp proxy
Include session cookie
Output & Evasion
Save output as HTML report
Save as CSV
Save as XML
IDS evasion: random URI encoding
IDS evasion: directory self-reference /./
IDS evasion: Windows directory separator
Add 1 second delay between requests
AWS CLI — Cloud Penetration Testing
AWS CLI commands for cloud penetration testing: IAM enumeration, S3 attacks, EC2 SSRF, privilege escalation.
FFUF (Fuzz Faster U Fool) — high-speed web fuzzer for directories, parameters, subdomains, and more.
Web Pentest
25 cmds
Directory & File Fuzzing
Basic directory fuzzing
Fuzz with multiple file extensions
Match specific response codes
Filter out 404 responses
Filter by response size
Filter by word count in response
Set 100 concurrent threads
Recursive directory fuzzing
Subdomain & VHost Fuzzing
Subdomain enumeration
Virtual host (vhost) fuzzing
Vhost fuzzing filtering by size
Parameter & Value Fuzzing
Fuzz GET parameter names
Fuzz GET parameter values (IDOR)
POST parameter fuzzing (username enum)
Password brute force via POST
Fuzz with authentication cookie
Authentication & Headers
Fuzz with Bearer token
Fuzz with session cookie
Set cookies via -b flag
Proxy through Burp Suite
Output & Advanced
Save output as JSON
Save output as HTML report
Auto-calibrate filter (smart baseline)
Limit requests per second
Multi-wordlist fuzzing with named positions
Burp Suite — Web Application Testing Proxy
Burp Suite CLI tools and key workflows for web application security testing.
Web Pentest
27 cmds
Burp CLI & Startup
Start Burp Suite Community
Start Burp Pro with 2GB heap
Open existing project file
Load configuration from file
Proxy & Intercept
Send curl request through Burp proxy
HTTPS request through Burp (skip cert check)
Set Burp as system proxy for all tools
Route Python script through Burp
Intruder Attack Types
One position, one wordlist (username enum, fuzzing)
Same payload everywhere (user=FUZZ&pass=FUZZ)
Paired lists (user list + password list, row by row)
Full combo attack (every user x every password)
Repeater & Decoder
Send intercepted request to Repeater for manual testing
Send to Intruder for automated attack
URL decode in Decoder or Repeater
Base64 encode in Decoder
Scanner & Active Scan (Pro)
Run active scan via Burp Pro CLI
Launch active scan on specific request
Crawl + audit full target
Useful Extensions (BApp Store)
Better request logging with filtering
Replay requests with lower-privilege tokens
JWT manipulation and algorithm confusion
Find hidden GET/POST/header params
Additional vulnerability checks for Pro Scanner
Automated CORS vulnerability testing
Dynamic payload transforms inline in Repeater
Automated file upload exploitation
Command Injection
OS command injection — separators and substitution, blind/time-based detection, OOB exfiltration, space/keyword/WAF bypasses, reverse shells and Windows command injection.
Web Pentest
29 cmds
Separators
Chain a second command (semicolon)
Pipe into the injected command
Run only if the first command fails
Background separator (also Windows)
Run if the first command succeeds
Backtick command substitution
Modern command substitution
URL-encoded newline as a separator
Blind / Time-Based
Confirm blind injection via a delay (Unix)
Time delay via substitution
Unix delay via ping
Windows delay via ping
Out-of-Band Exfil
Exfil command output via an HTTP callback
DNS exfil of command output
POST a file to your listener
Base64 the output to survive URL/DNS rules
Space & Keyword Bypass
${IFS} substitutes for a blocked space
Brace expansion avoids spaces
Input redirection instead of a space
Empty quotes break keyword matching
Glob wildcards avoid literal binary names
Base64-decode then execute
Reverse Shells
Bash reverse shell
Netcat reverse shell
Netcat (no -e) FIFO reverse shell
Windows
Windows command separator
Download + execute a payload (certutil)
Run an encoded PowerShell command
PowerShell download-cradle
Insecure Deserialization
Insecure deserialization across languages — stream fingerprinting, Java ysoserial gadget chains, PHP phpggc + manual objects, Python pickle/PyYAML, .NET ysoserial.net (ViewState/BinaryFormatter), Ruby Marshal and Node node-serialize.
Web Pentest
22 cmds
Detection & Magic Bytes
Java serialized object signature
PHP serialized object / array
Python pickle stream
.NET BinaryFormatter stream
Ruby Marshal data
Java — ysoserial
Detect deserialization with a dependency-free DNS callback
Generate a CommonsCollections RCE gadget
BeanUtils gadget (common on Jenkins / Spring apps)
Spring gadget chain
PHP — phpggc & Manual
List every available PHP gadget chain
Generate a Laravel RCE gadget chain
Monolog gadget, base64 output
Hand-craft an object to hit a __wakeup/__destruct gadget
Trigger object instantiation via the phar:// wrapper
Python — pickle / PyYAML
Build a base64 pickle RCE payload via __reduce__
PyYAML RCE via unsafe load / full_load
PyYAML RCE that returns command output
.NET — ysoserial.net
Generate a BinaryFormatter RCE payload
Forge a malicious ASP.NET ViewState (leaked machineKey)
Abuse polymorphic type handling in Json.NET
Ruby / Node
Ruby 2.x–3.x universal deserialization RCE gadget
node-serialize RCE via an IIFE function
Coercion & mitm6 — Forced Authentication
Force machine accounts to authenticate to you and relay it — PetitPotam, PrinterBug, DFSCoerce, ShadowCoerce, Coercer and mitm6, paired with ntlmrelayx / Certipy relay (RBCD, Shadow Credentials, ESC8).
Active Directory
20 cmds
mitm6 — IPv6 DNS Takeover
Spoof DHCPv6 to become the network's IPv6 DNS server (WPAD/auth capture)
Only answer FQDN queries for the target domain — quieter, less breakage
Restrict spoofing to a single victim host (targeted)
Relay the IPv6/WPAD-captured machine auth to LDAPS → configure RBCD
Relay → add a new computer account (then use it for RBCD)
PetitPotam — MS-EFSRPC
Unauthenticated EFSRPC coercion (unpatched DCs) — listener then target
Abuse the Print Spooler RPC to coerce the target to auth to your listener
Alternative SpoolSample/PrinterBug trigger
Check whether the MS-RPRN (Spooler) interface is exposed first
DFSCoerce / ShadowCoerce
MS-DFSNM coercion — works even when the Spooler is disabled
MS-FSRVP (VSS) coercion — another no-Spooler path
Coercer — All-in-One
Enumerate which coercion methods/pipes the target actually exposes
Fire every available coercion method at the target at once
Trigger one specific RPC method only
Relay Combos (where the coerced auth goes)
Relay coerced machine auth to LDAPS → grant RBCD over the victim computer
Relay → add Shadow Credentials (msDS-KeyCredentialLink) on the DC
ESC8 — relay coerced DC$ auth to AD CS web enrollment to mint a DC cert
Relay to SMB and stash the session in a SOCKS proxy for reuse
JWT Attacks
JSON Web Token attacks — decoding, alg=none, weak-secret cracking (hashcat/jwt_tool), RS256→HS256 key confusion, claim tampering and kid/jku/x5u header injection.
Web Pentest
16 cmds
Recon & Decode
Decode header + payload without verifying
Parse and display a token with jwt_tool
Interactive tamper mode
alg=none Bypass
Forge a token with alg=none (strip the signature)
Manual alg=none — note the trailing dot, empty signature
Weak Secret Cracking
Crack an HS256 signing secret offline
Dictionary-crack the HMAC secret with jwt_tool
Crack the secret with John
Key Confusion (RS256 -> HS256)
Sign with the RSA public key as the HMAC secret (alg confusion)
Recover the server public key for the confusion attack
Claim Tampering
Escalate by editing privilege claims, then re-sign
Inject a claim and re-sign with a known secret
Header Injection (kid / jku / x5u)
kid path traversal → sign with an empty/known key
kid SQL injection to control the verification key
jku/x5u header → point verification at your JWKS
Run all tests against a live endpoint
SSTI — Server-Side Template Injection
Server-Side Template Injection — engine detection plus RCE payloads for Jinja2, Twig, Freemarker, Velocity, Spring SpEL, Thymeleaf, Smarty, Mako and ERB.
Web Pentest
24 cmds
Detection
49 → Jinja2 / Twig
49 → Freemarker / Spring SpEL / JSP EL
49 → Ruby (Slim) / Thymeleaf
49 → ERB (Ruby) / EJS
7777777 → Jinja2; 49 → Twig (disambiguate the two)
Polyglot — fire everywhere and watch which errors
Jinja2 (Python)
Dump the Flask config (frequently contains secrets)
RCE via cycler globals (modern, reliable)
RCE via the lipsum global
RCE via request globals
RCE via self/builtins
Twig (PHP)
RCE via the undefined-filter callback
RCE via the filter() function
RCE via the sort() callback
Java — Freemarker / Velocity
Freemarker RCE via Execute
Freemarker one-liner RCE
Velocity RCE chain
Java — Spring SpEL / Thymeleaf
Spring SpEL RCE
Thymeleaf preprocessing RCE
Thymeleaf expression RCE
Smarty / Mako / ERB
Smarty (PHP) direct command exec
Smarty {php} tag (older versions)
Mako (Python) RCE
ERB (Ruby) command exec
NoSQL Injection
NoSQL injection (MongoDB-focused) — authentication bypass with operators, query operator injection, blind regex extraction, server-side $where JavaScript injection, JSON vs form delivery, and NoSQLMap/ffuf tooling.
Web Pentest
23 cmds
Authentication Bypass
Operator injection — "not equal to null" matches any password
Log in as the first user when both fields are bypassed
Greater-than-empty matches any set password
Form/URL-encoded operator injection
Regex-match the username, bypass the password
Query Operator Injection
Match anything that is not null
Range operators to match populated fields
Match any value from a list
Filter on field presence
Wildcard regex match
Blind Extraction (Regex Oracle)
Confirm the first character, then iterate the alphabet
Character-by-character extraction of a secret field
Boolean oracle drives blind NoSQLi
JavaScript Injection ($where)
Run server-side JavaScript inside the query
Time-based blind via $where
Break out of a string into the $where JS context
Arbitrary JS predicate
Encoding & Delivery
Send real operator objects (not strings) in a JSON body
Express/PHP parse bracket params into nested operators
Operator injection through query-string bracket notation
Tooling
Automated MongoDB / NoSQL injection + enumeration
Fuzz operator names into bracket parameters
Manual operator injection in Repeater
XXE — XML External Entity
XML External Entity attacks — local file read, SSRF, PHP filter/expect wrappers, blind & error-based out-of-band exfiltration via external DTDs, XInclude, SVG/Office documents and entity-expansion DoS.
Web Pentest
15 cmds
Basic File Read
Read a local file via an external entity
Windows local file read
Directory listing on some Java parsers
SSRF via XXE
Reach cloud metadata through XXE
Hit an internal-only service
PHP Wrappers
Base64-wrap to read files with special chars (PHP)
Read application PHP source code
Command exec if the PHP expect wrapper is enabled
Blind / Out-of-Band
Load an external DTD for out-of-band exfil
External DTD that exfiltrates a file over HTTP
Leak file contents inside a parser error message
Other Vectors
XInclude — works when you cannot control the DOCTYPE
XXE through an uploaded SVG
XXE via Office Open XML documents
Billion Laughs entity-expansion DoS
GraphQL Attacks
GraphQL security testing — endpoint discovery and engine fingerprinting, introspection (and recovery when disabled), IDOR/authz via nodes & mutations, batching rate-limit bypass, DoS and injection.
Web Pentest
17 cmds
Discovery
Confirm a GraphQL endpoint
Hunt the endpoint + any exposed IDE
Fingerprint the GraphQL engine
Introspection
Full introspection — dump the schema
List all queries and mutations
Inspect a specific type's fields
Recover the schema even when introspection is disabled
Authz / IDOR
IDOR via a node argument
Authz bypass / mass assignment via a mutation
Relay global-id IDOR (base64 of type:id)
Rate-Limit Bypass (Batching)
Alias many attempts in ONE request to beat rate limits
Array/JSON batching — send many operations at once
DoS
Deeply nested / circular query to exhaust resources