Cheatsheets — LazyHackers

Nmap — Network Scanning & Enumeration

Complete Nmap reference for host discovery, port scanning, service detection, and NSE scripting.

Network Pentest

46 cmds

Host Discovery

Ping sweep — discover live hosts (no port scan)

TCP SYN ping on specific ports

TCP ACK ping sweep

UDP ping sweep

ARP ping (local network)

Ping sweep from target list file

Port Scanning

Scan all 65535 ports

Scan specific ports

Scan port range

Fast scan — top 100 ports

Scan top 1000 most common ports

SYN (stealth) scan — requires root

TCP connect scan (no root needed)

UDP scan common ports

ACK scan — map firewall rules

Service & Version Detection

Service/version detection

Aggressive version detection

OS detection

Aggressive scan: OS+version+scripts+traceroute

Version + default NSE scripts

NSE Scripts

Run default scripts

Get HTTP page titles

Run all vulnerability scripts

Check EternalBlue (MS17-010)

SMB enumeration

Check FTP anonymous login

SSH authentication methods

DNS zone transfer attempt

Enumerate web directories

Check Heartbleed vulnerability

MySQL enumeration

MSSQL enumeration

Output & Timing

Save normal output to file

Save XML output

Greppable output

Save all formats (normal+xml+grep)

T4 timing (faster, less stealthy)

T1 timing (very slow, stealthy)

Set minimum packet rate for speed

Evasion & Firewall Bypass

Fragment packets to evade IDS

Decoy scan with 10 random IPs

Decoy scan with specific IPs

Spoof source port (bypass firewall rules)

Append random data to packets

Randomize target scan order

Scan through SOCKS proxy/Tor

Burp Suite — Web Application Testing Proxy

Burp Suite CLI tools and key workflows for web application security testing.

Web Pentest

27 cmds

Burp CLI & Startup

Start Burp Suite Community

Start Burp Pro with 2GB heap

Open existing project file

Load configuration from file

Proxy & Intercept

Send curl request through Burp proxy

HTTPS request through Burp (skip cert check)

Set Burp as system proxy for all tools

Route Python script through Burp

Intruder Attack Types

One position, one wordlist (username enum, fuzzing)

Same payload everywhere (user=FUZZ&pass=FUZZ)

Paired lists (user list + password list, row by row)

Full combo attack (every user x every password)

Repeater & Decoder

Send intercepted request to Repeater for manual testing

Send to Intruder for automated attack

URL decode in Decoder or Repeater

Base64 encode in Decoder

Scanner & Active Scan (Pro)

Run active scan via Burp Pro CLI

Launch active scan on specific request

Crawl + audit full target

Useful Extensions (BApp Store)

Better request logging with filtering

Replay requests with lower-privilege tokens

JWT manipulation and algorithm confusion

Find hidden GET/POST/header params

Additional vulnerability checks for Pro Scanner

Automated CORS vulnerability testing

Dynamic payload transforms inline in Repeater

Automated file upload exploitation

LinPEAS & WinPEAS — Privilege Escalation Scripts

PEASS-ng scripts for automated local privilege escalation enumeration on Linux and Windows.

Privilege Escalation

30 cmds

LinPEAS — Linux

Download and run LinPEAS (pipe to sh)

Download, make executable, run

Run and save output to file

All checks (slower but thorough)

Super fast mode (less checks)

Quiet mode — less noise in output

Serve linpeas from attacker box, run in memory

LinPEAS — Key Findings to Check

Red = critical finding, Yellow = interesting

Find SUID binaries manually

Find SGID binaries

List sudo permissions for current user

Check cron jobs

Find world-writable files/dirs

Find users with shells

List listening ports

Check home dirs and SSH keys

WinPEAS — Windows

Run WinPEAS 64-bit

Run WinPEAS 32-bit

Run and save output to file

Quiet mode — suppress banner

System info only

Services info only

Download WinPEAS via certutil

Download and run WinPEAS PS1 in memory

WinPEAS — Key Manual Checks

List current user privileges (look for SeImpersonate, SeDebug)

Full user context, groups, and privileges

List users and local admins

Find non-standard auto-start services

Check AlwaysInstallElevated (MSI privesc)

List scheduled tasks with run-as context

Subfinder & Amass — Subdomain Enumeration

Passive and active subdomain enumeration with Subfinder and Amass.

Recon

21 cmds

Subfinder

Basic subdomain enumeration

Save results to file

Verbose mode — show source of each subdomain

Use all sources (slower but more results)

Recursive subdomain enumeration

Enumerate subdomains for multiple domains

Custom threads and timeout

Use API keys config file

Amass Enum

Basic passive enumeration

Active enumeration (DNS brute force + passive)

Save output to file

DNS brute force with wordlist

Show source + IP for each subdomain

Limit DNS queries per second

WHOIS-based org/ASN intel gathering

Enumerate domains owned by ASN

Post-Processing & Chaining

Find live HTTP hosts from subdomains

Get title, tech stack, status for each subdomain

Resolve subdomains to IPs with dnsx

Deduplicate subdomain list

Combine Amass + Subfinder results

Netcat & Socat — Network Swiss Army Knife

Netcat and Socat for reverse shells, port forwarding, file transfer, and network debugging.

Exploitation

27 cmds

Netcat Listeners & Connect

Start listener on port 4444

Connect to remote host:port

Bind shell on Linux (listen)

Reverse shell to attacker (Linux)

Reverse shell to attacker (Windows)

Reverse Shells (One-liners)

Bash TCP reverse shell

Bash reverse shell (command injection safe)

Python3 reverse shell

PHP reverse shell

Perl reverse shell

Ruby reverse shell

PowerShell reverse shell

Shell Stabilisation (TTY)

Upgrade to PTY shell with Python

Full TTY upgrade (raw mode)

Upgrade shell using script command

Alternative shell upgrade with script

Set terminal size in upgraded shell

Socat

Socat bind shell listener

Socat reverse shell to attacker

Socat fully stable PTY listener

Socat PTY reverse shell (no upgrade needed)

Port forward: localhost:8080 → target:80

Debug mode — verbose output

File Transfer

Receive file via netcat (attacker)

Send file via netcat (victim)

Socat file receive

Socat file send

NetExec (CrackMapExec) — AD Lateral Movement

NetExec (nxc) — the Swiss Army knife for Windows/AD lateral movement, credential spraying, and post-exploitation.

Active Directory

53 cmds

SMB Enumeration & Auth

Discover SMB hosts on subnet

Test SMB credentials

SMB pass-the-hash

Spray credentials across subnet

Credential spray with lists

Enumerate SMB shares

List active SMB sessions

Enumerate domain users via SMB

Enumerate domain groups

Get password policy

RID brute force to enumerate users/groups

List logged-on users (hunt where admins are sitting)

Authenticate with a LOCAL account instead of domain

Null-session enumeration (no creds)

List domain computer objects

Find hosts with SMB signing OFF (relay target list)

Code Execution

Execute command via SMB

Execute PowerShell command

Execute via WinRM (PS Remoting)

Execute via WMI

Choose the exec method (atexec / smbexec / wmiexec / mmcexec)

Upload a file to the target

Download a file from the target

Credential Dumping

Dump SAM hashes (local admin needed)

Dump LSA secrets

DCSync — dump NTDS.dit (DA needed)

Run Mimikatz module

LSASS dump with lsassy module

Dump & decrypt DPAPI secrets (saved creds, browser, vaults)

Read LAPS local-admin passwords (where authorized)

DCSync-style NTDS dump over DRSUAPI

Dump LSASS via nanodump (more EDR-evasive)

Recover cPassword from SYSVOL GPP (MS14-025)

LDAP & Other Protocols

AS-REP Roasting via LDAP

Kerberoasting via LDAP

Collect BloodHound data via LDAP

Dump gMSA passwords

MSSQL query execution

MSSQL with local auth

SSH command execution

Test RDP credentials on subnet

Read LAPS passwords over LDAP

Find unconstrained-delegation accounts

Accounts with PASSWD_NOTREQD set

Enumerate AD CS certificate authorities

Dump user descriptions (often contain passwords)

Sweep hosts for WinRM (evil-winrm) access

Modules & Spidering

Spider every readable share and index files (JSON output)

Spider a specific share for a keyword

Find autologon credentials in Group Policy

Enumerate installed AV / EDR products

Read the domain MachineAccountQuota

List all available NetExec modules for a protocol

MSFVenom — Payload Generation

MSFVenom combines msfpayload and msfencode for generating custom shellcode and payloads.

Exploitation

24 cmds

Windows Payloads

64-bit Windows Meterpreter EXE

32-bit Windows Meterpreter EXE

Windows DLL payload

PowerShell payload

HTTPS reverse shell (evades inspection)

Plain Windows reverse shell (no Meterpreter)

Linux Payloads

64-bit Linux Meterpreter ELF

32-bit Linux plain shell ELF

Linux reverse shell + make executable

Web Payloads

PHP Meterpreter webshell

JSP reverse shell (Tomcat/JBoss)

WAR file for Java servers

ASPX webshell for IIS

Python Meterpreter payload

Android & macOS

Android APK Meterpreter payload

macOS Meterpreter payload

Encoders & Evasion

List all available encoders

XOR encode payload 10 times

Double encode via pipe

Inject payload into legitimate binary

Generate smallest possible payload

Multi/Handler Listener

Set up payload listener in msfconsole

Set matching payload for handler

Start listener as background job

SQLMap — SQL Injection Automation

SQLMap automates detection and exploitation of SQL injection vulnerabilities across all major databases.

Web Pentest

28 cmds

Basic Detection

Test GET parameter for SQLi

Enumerate databases

List tables in a database

List columns in a table

Dump specific columns

Dump all databases

POST Requests & Forms

Test POST parameters

Test from saved Burp request file

Test specific POST parameter

POST with authentication cookie

Authentication & Session

Inject with session cookie

Inject with Bearer token

HTTP Basic authentication

Techniques & Evasion

All techniques: Boolean, Error, Union, Stacked, Time

Time-based blind only

Use tamper script for WAF bypass

Chain multiple tamper scripts

Random User-Agent to avoid detection

Slow down requests (IDS evasion)

Route through Burp proxy

Max level & risk (most aggressive)

OS & Privilege Escalation

Get current DB user, database, hostname

Check if current user is DBA

Read local file (MySQL FILE priv)

Write webshell to server

Interactive OS shell via SQLi

Execute single OS command

Dump DB user password hashes

Volatility — Memory Forensics

Volatility 3 framework for memory forensics — process analysis, credential extraction, and malware investigation.

Forensics

23 cmds

Core Analysis

Get OS info from Windows memory dump

Get kernel banner from Linux dump

List running processes (Windows)

Process tree (parent-child relationships)

Scan for process structures (finds hidden procs)

Show command line args for each process

List DLLs loaded by process 1234

List handles for process 1234

Network & Connections

Network connections and sockets

Scan for network artifacts (more complete)

Credentials & Hashes

Dump NTLM password hashes from memory

Dump LSA secrets from memory

Dump cached domain credentials

Registry & Files

List registry hives in memory

Read registry autorun key

Scan for file objects in memory

Extract file from process memory

Malware Analysis

Find injected code / memory anomalies

Dump suspicious memory regions to disk

Detect process hollowing

Virtual address descriptor info for process

Dump full process memory map

Search strings within process memory

Wireshark & TCPDump — Packet Analysis

Capture and analyze network traffic with Wireshark and TCPDump for credential interception and protocol analysis.

Network Pentest

29 cmds

TCPDump — Capture

Capture all traffic on eth0

Capture on all interfaces

Save capture to PCAP file

Full packet capture (no truncation)

Capture traffic to/from specific host

Capture HTTP traffic only

Capture HTTPS/TLS traffic

Capture FTP/Telnet/POP3 (cleartext creds)

Capture from subnet, no DNS resolve

Print HTTP payload as ASCII

Print hex+ASCII payload for HTTP

Read and analyze saved PCAP file

Wireshark Display Filters

Show only HTTP traffic

Show only HTTP POST requests

Show traffic to/from IP

Show traffic on specific port

Show only SYN packets (new connections)

Find HTTP packets containing "password"

Show cleartext credential protocols

Show only DNS traffic

Show SMB traffic (NTLMv2 hashes)

Find NTLM authentication frames

Exclude noise (ARP, ICMP, DNS)

Show TCP issues (retransmissions, resets)

Wireshark CLI (tshark)

Capture to PCAP via CLI

Extract HTTP request URIs from PCAP

Extract POST data payloads

Extract FTP credentials from capture

Export all HTTP objects (files) from PCAP

Nuclei — Fast Vulnerability Scanner

Nuclei is a fast, template-based vulnerability scanner for web apps, networks, and cloud infrastructure.

Web Pentest

20 cmds

Basic Scanning

Scan single target with all templates

Scan list of targets from file

Scan with custom template directory

Save results to file

Save results as JSON

Update all templates to latest

Template Filtering

Run only exposure templates

Run only CVE templates

Run only 2023 CVE templates

Run vulnerability templates

Run misconfig templates

Run templates with specific tags

Only run critical and high severity templates

Exclude DoS templates (safe mode)

Proxy, Auth & Speed

Route through Burp proxy

Add custom header (auth)

Set 50 concurrent requests

Limit to 100 requests/second

Set 10 second timeout

Full pipeline: subdomains → live hosts → CVE scan

Responder — LLMNR/NBT-NS Poisoning

Responder poisons LLMNR, NBT-NS, and mDNS to capture NTLMv2 hashes from Windows hosts on the local network.

Active Directory

14 cmds

Basic Usage

Start Responder with rogue DHCP, DNS, WPAD, verbose

Analyze mode only — passive, no poisoning

Default mode — LLMNR + NBT-NS poison

Enable ProxyAuth (WPAD credential capture)

Fingerprint hosts before poisoning

Cracking Captured Hashes

View captured NTLMv2 hashes

Crack NTLMv2 hashes with Hashcat

Crack NTLMv2 with John

Relay Attacks (with ntlmrelayx)

Downgrade to NTLMv1 (for relay)

Relay captured hashes to target list

Relay + create admin user

Disable Responder SMB/HTTP servers for relay to work

MultiRelay & WPAD

MultiRelay attack against specific target

WPAD + ProxyAuth captures plaintext creds from IE/Chrome

Hydra — Online Password Brute Force

Hydra is a fast, parallelized online password cracker supporting 50+ protocols.

Exploitation

22 cmds

SSH, FTP, RDP

SSH brute force single username

SSH brute force user+pass lists

FTP brute force

RDP brute force

RDP with 4 threads (RDP is slow)

SSH on non-standard port 2222

Web Forms (HTTP)

HTTP POST form brute force

HTTP GET form brute force

HTTPS POST form brute force

WordPress wp-login.php brute force

Other Protocols

SMB/Windows shares brute force

MySQL brute force

MSSQL brute force

Telnet brute force

SMTP brute force

POP3 brute force

LDAP brute force

Use colon-separated credential file (user:pass)

Speed & Output

20 tasks, 30s timeout, verbose output

Save found credentials to file

Restore previous interrupted session

Generate passwords: 4-6 chars, lower+upper+digits

Impacket — Windows & Active Directory Attacks

Impacket Python library with tools for SMB, MSRPC, Kerberos, NTLM, WMI, and AD attacks.

Active Directory

58 cmds

Authentication & Relay

PSExec — get SYSTEM shell via SMB

PSExec with pass-the-hash

SMBExec — alternative to PSExec (no file drop)

WMIExec — code exec via WMI (no service)

WMIExec pass-the-hash

NTLM relay attack to target list

NTLM relay — interactive SMB shell

NTLM relay — execute binary on target

Relay to LDAP for privilege escalation

AtExec — command execution via the Task Scheduler service

DCOMExec — code exec via DCOM (MMC20 / ShellWindows / ShellBrowserWindow)

Drop-the-MIC relay bypass (CVE-2019-1040)

Relay machine auth to LDAPS and grant RBCD over the relayed computer

Relay to LDAPS and add Shadow Credentials (msDS-KeyCredentialLink)

ESC8 — relay machine auth to AD CS web enrollment to mint a cert

Hold relayed sessions in a SOCKS proxy pool for later use

Kerberos Attacks

Kerberoasting — dump TGS hashes for SPNs

AS-REP Roasting — users with no pre-auth

AS-REP Roast all domain users (anonymous)

Forge Silver Ticket for service

Forge Golden Ticket (krbtgt hash needed)

Pass-the-Ticket: use .ccache for auth

Request a TGT and save it as a .ccache (then export KRB5CCNAME)

S4U2Self+S4U2Proxy — impersonate a user via constrained delegation

RBCD — request a service ticket as an impersonated user

Forge a SILVER ticket for a single service (offline, no DC contact)

Child → parent domain escalation (auto golden + cross-domain)

Convert Rubeus .kirbi ↔ Impacket .ccache ticket formats

Decode and inspect a ccache/kirbi ticket (flags, keys, PAC)

Credential Dumping

Dump SAM, LSA, cached creds remotely

secretsdump with pass-the-hash

Offline NTDS.dit dump (local files)

DCSync — dump all domain hashes (DA needed)

Full DCSync — NTLM hashes + Kerberos keys (incl. krbtgt) + history

Targeted DCSync — pull only krbtgt (for golden tickets)

Dump NTDS.dit via a Volume Shadow Copy

Offline parse of exported registry hives (local hashes + LSA + cached)

Decrypt a DPAPI masterkey blob

Decrypt a DPAPI credential blob with a recovered masterkey

Enumeration & SMB

Interactive SMB client

SMB client with hash

Enumerate users/groups via SID bruteforce

Dump RPC endpoints

Remote registry query

MSSQL interactive client

MSSQL with Windows auth

List all domain users with last-logon / pwd-last-set

Enumerate users, groups and aliases via MS-SAMR

Enumerate unconstrained / constrained / RBCD delegation

List / start / stop / create remote Windows services

Host an SMB share (file transfer, or capture/relay auth)

Recover cPassword secrets from Group Policy Preferences (MS14-025)

ACL & Delegation Abuse

Grant DCSync rights to a controlled principal (DACL abuse)

Read the ACEs in an object DACL

Take ownership of an object (WriteOwner abuse)

Force-reset a target password (ForceChangePassword / GenericAll ACL)

Add a machine account (uses MachineAccountQuota) for RBCD/shadow-creds

Write msDS-AllowedToActOnBehalfOfOtherIdentity (configure RBCD)

API Security — OWASP API Top 10

REST API penetration testing mapped to the OWASP API Security Top 10 — endpoint/spec discovery, BOLA/BFLA, broken auth, mass assignment & data exposure, resource consumption, SSRF, CORS/misconfig, shadow versions and tooling.

Web Pentest

25 cmds

Recon & Discovery

Hunt API docs that map the entire attack surface

Brute API routes — 401/403 still reveal hidden endpoints

Kiterunner — content discovery tuned for API routes

Crawl and extract API endpoints from JavaScript

Version & shadow-API discovery (API9)

API1 / API5 — BOLA & BFLA

API1 BOLA — read/modify others' objects by changing IDs

API5 BFLA — invoke admin-only functions

Automate authorization testing across the whole API

API2 — Broken Authentication

API2 — brute/stuff when login isn't throttled

Brute the login endpoint

Token and key weaknesses

Account takeover via a weak reset flow

API3 — Mass Assignment & Data Exposure

API3 BOPLA — inject privileged fields the API binds blindly

Excessive data exposure — the server over-returns

Object property-level authorization bypass

API4 — Resource Consumption

API4 — melt the DB/memory with huge page sizes

Cost & DoS via unbounded operations

Parser resource exhaustion

API7 / API8 / API9 — SSRF, Misconfig, Inventory

API7 SSRF via URL-accepting fields

API8 — permissive CORS leaking authenticated data

API8 misconfiguration probes

API9 — deprecated/shadow versions skip new controls

Tooling

Automated API misconfig/exposure checks

Discover hidden JSON parameters

Build the request corpus to fuzz

John the Ripper — Password Cracking

John the Ripper — versatile password cracker with hash extraction helpers for common file formats.

Exploitation

23 cmds

Basic Cracking

Auto-detect hash and crack with default wordlist

Dictionary attack with rockyou

Dictionary + mangling rules

Crack NTLM hashes specifically

Crack Linux SHA512crypt shadow hashes

Crack bcrypt hashes

Show cracked passwords

List all supported hash formats

Hash Extraction Tools (John suite)

Combine passwd+shadow for cracking

Crack password-protected ZIP

Crack password-protected RAR

Crack PDF password

Crack SSH private key passphrase

Crack Office document password

Crack KeePass database

Crack 7-Zip archive password

Advanced Options

Brute force with incremental mode

Brute force digits only

Mask attack pattern

Use 4 CPU cores in parallel

Custom pot file path

Resume interrupted session

Name the cracking session

WPScan — WordPress Security Scanner

WPScan is a WordPress security scanner for finding vulnerabilities, weak passwords, and exposed files.

Web Pentest

19 cmds

Basic Scanning

Basic WordPress scan

Full enumeration (plugins, themes, users)

Enumerate users only

Enumerate plugins only

Enumerate themes only

Enumerate only vulnerable plugins

Enumerate only vulnerable themes

Enumerate ALL plugins (aggressive, slow)

Password Attacks

Brute force admin password

Brute force multiple users

Enumerate users then brute force

Brute force with 20 threads

Advanced Options

Use WPScan API token for vuln data

Route through Burp proxy

Aggressive detection (more requests)

Save output as JSON report

Bypass HTTP basic auth

Scan as authenticated user

Randomize User-Agent per request

ADB — Android Debug Bridge

ADB (Android Debug Bridge) for device interaction, app analysis, and Android penetration testing.

Mobile Pentest

30 cmds

Connection & Setup

List connected devices/emulators

Connect to device over network (TCP/IP mode)

Enable ADB over TCP/IP on port 5555

Connect to specific device by ID

Restart ADB daemon as root

Wait for device to come online

Shell & Commands

Open interactive shell on device

Check current user on device

List all installed packages

List only third-party apps

Get APK path for package

Full package info (perms, activities, etc)

Activity stack info

Launch specific app activity

Send deeplink intent

Get device model

Get Android SDK version

File Operations

Pull app data directory (needs root)

Pull file from SD card

Push file to device

List app data directory

Read shared preferences

Read SQLite database

APK Extraction & Logging

Extract installed APK from device

Install APK to device

Uninstall package

View app-specific logcat logs

Filter logcat by tag

Save full logcat to file

Take screenshot from device

Hashcat — Offline Password Cracking

Hashcat is the world's fastest password recovery tool supporting 300+ hash types and GPU acceleration.

Exploitation

32 cmds

Hash Identification & Modes

Auto-identify hash type

Identify hash with hashid tool

MD5 crack with wordlist

SHA1 crack

SHA256 crack

SHA512crypt ($6$) — Linux shadow

MD5crypt ($1$) — Linux shadow

NTLM hash (Windows)

NetNTLMv2 (Responder captures)

Kerberoast TGS hash ($krb5tgs$23$)

AS-REP Roast ($krb5asrep$23$)

bcrypt ($2*$) — common web apps

IPMI2 RAKP HMAC-SHA1

RSA/DSA/EC/OpenSSH private key

Attack Modes

Dictionary attack (-a 0)

Combination attack: combine two wordlists (-a 1)

Brute force 6-char all charset (-a 3)

Hybrid: wordlist + mask suffix (-a 6)

Hybrid: mask prefix + wordlist (-a 7)

Dictionary + best64 rules

Dictionary + OneRuleToRuleThemAll

Mask Attack (Brute Force)

Hashcat mask character reference

Mask: 1 upper + 4 lower + 3 digits

Incremental mask attack 4-8 chars

Custom charset: lowercase + digits, 8 chars

Performance & GPU

Workload profile 3 (high performance)

Force run (ignore warnings, useful in VMs)

Use GPU device 1 only

Show status every 10 seconds

Disable potfile (crack same hash again)

Show already-cracked hashes from potfile

Benchmark NTLM cracking speed

SSTI — Server-Side Template Injection

Server-Side Template Injection — engine detection plus RCE payloads for Jinja2, Twig, Freemarker, Velocity, Spring SpEL, Thymeleaf, Smarty, Mako and ERB.

Web Pentest

24 cmds

Detection

49 → Jinja2 / Twig

49 → Freemarker / Spring SpEL / JSP EL

49 → Ruby (Slim) / Thymeleaf

49 → ERB (Ruby) / EJS

7777777 → Jinja2; 49 → Twig (disambiguate the two)

Polyglot — fire everywhere and watch which errors

Jinja2 (Python)

Dump the Flask config (frequently contains secrets)

RCE via cycler globals (modern, reliable)

RCE via the lipsum global

RCE via request globals

RCE via self/builtins

Twig (PHP)

RCE via the undefined-filter callback

RCE via the filter() function

RCE via the sort() callback

Java — Freemarker / Velocity

Freemarker RCE via Execute

Freemarker one-liner RCE

Velocity RCE chain

Java — Spring SpEL / Thymeleaf

Spring SpEL RCE

Thymeleaf preprocessing RCE

Thymeleaf expression RCE

Smarty / Mako / ERB

Smarty (PHP) direct command exec

Smarty {php} tag (older versions)

Mako (Python) RCE

ERB (Ruby) command exec

Gobuster — Directory & DNS Brute Force

Gobuster — fast brute-forcing tool for directories, DNS subdomains, virtual hosts, and S3 buckets.

Web Pentest

19 cmds

Directory/File Mode (dir)

Basic directory brute force

Brute force with file extensions

Only show specific status codes

Blacklist (ignore) status codes

50 threads, quiet mode

Skip TLS/SSL certificate verification

Include cookies in requests

Custom header (Bearer token)

Save results to file

Proxy through Burp Suite

DNS Subdomain Mode (dns)

DNS subdomain enumeration

Fast DNS enum with output

Show CNAME records (useful for takeover)

Use custom DNS resolver

VHost Mode (vhost)

Virtual host brute force

Append domain to wordlist entries

Exclude responses of specific length

S3 & Fuzzing Mode

Brute force S3 bucket names

Generic fuzzing mode

theHarvester — OSINT Email & Domain Recon

theHarvester gathers emails, names, subdomains, IPs and URLs from multiple public sources.

Recon

15 cmds

Basic Recon

Use all sources for recon

Google dorking for emails/subdomains

Bing search for emails/subdomains

LinkedIn employee enumeration

Shodan infrastructure intel

Certificate transparency logs

Hunter.io email discovery (API key required)

DNS records via DNSDumpster

Options & Output

Limit to 200 search results

Save results to HTML and XML files

Verbose output

Start at result offset 50

DNS reverse lookup on discovered IPs

DNS brute force with TLD expansion

Perform DNS TLD expansion

BloodHound — Active Directory Attack Path Analysis

BloodHound maps Active Directory attack paths using graph theory to find privilege escalation routes.

Active Directory

19 cmds

Data Collection (SharpHound / BloodHound.py)

Python collector — collect all data

Collect and auto-zip for import

Collect DC info only (faster, stealthier)

Use TCP DNS with custom resolver

SharpHound Windows binary — collect all

SharpHound collect + zip output

Session loop collection for 2 hours

BloodHound collection via NetExec

BloodHound Cypher Queries (Neo4j)

Find all DA/admin users

Shortest path to Domain Admins from any user

Shortest path from specific user to DA

Find all Kerberoastable users

Find AS-REP Roastable users

Find computers with unconstrained delegation

Find enabled users not logged in 90+ days

Find all admin groups

Setup & Launch

Start Neo4j then BloodHound GUI

Start Neo4j in foreground

Install bloodhound-python collector

Mimikatz — Windows Credential Dumping

Mimikatz extracts plaintext passwords, hashes, PIN codes, and Kerberos tickets from Windows memory.

Active Directory

42 cmds

Core Commands

Get SeDebugPrivilege (required for most ops)

Impersonate SYSTEM token

Dump plaintext passwords from LSASS memory

Dump WDigest credentials (older Windows)

Pass-the-Hash — spawn cmd as user

List Kerberos tickets in memory

Export all Kerberos tickets to .kirbi files

Dump Kerberos encryption keys (AES keys)

Dump DPAPI credentials

Dump NTLM/SHA1 hashes from LSASS (msv1_0 provider)

Dump Credential Manager secrets from LSASS

Dump cleartext creds cached by SSP providers

SAM & NTDS

Dump SAM database local hashes

Dump LSA secrets

DCSync — pull hash of specific user

DCSync — dump ALL domain hashes to CSV

Dump cached domain credentials (MSCache2)

Dump LSA secrets (service accounts, etc)

Targeted DCSync of krbtgt (golden-ticket material)

Dump inter-realm trust keys (forge inter-domain TGTs)

Export the domain DPAPI backup key — decrypts ANY user masterkey

DCShadow — push AD changes as a rogue DC (stealth persistence)

Kerberos Ticket Attacks

List and export Kerberos tickets

Pass-the-Ticket — inject .kirbi into session

Create Golden Ticket (offline)

Create Silver Ticket for service

Delete all Kerberos tickets from memory

Remote & Evasion

PowerSploit Invoke-Mimikatz (in-memory, no disk)

Run Mimikatz non-interactively

Dump LSASS process with ProcDump (then analyze offline)

Analyze offline LSASS dump

DPAPI & Vault

Decrypt a user DPAPI masterkey with their password

Decrypt a masterkey via the domain backup key (asks the DC over RPC)

Decrypt a DPAPI credential blob (masterkey must be cached)

Decrypt Chrome saved passwords via DPAPI

Dump stored Windows Vault credentials

List Windows Vault entries

Persistence & Advanced

Install Skeleton Key on the DC — a master password for every account (run with debug on the DC)

Remotely set a user's NTLM hash (needs reset rights)

Make CAPI keys exportable, then export machine certs + private keys (incl. CA key)

Add SID history (e.g. Domain Admins) to an account

Patch the event-log service in memory to stop logging

FFUF — Fast Web Fuzzer

FFUF (Fuzz Faster U Fool) — high-speed web fuzzer for directories, parameters, subdomains, and more.

Web Pentest

25 cmds

Directory & File Fuzzing

Basic directory fuzzing

Fuzz with multiple file extensions

Match specific response codes

Filter out 404 responses

Filter by response size

Filter by word count in response

Set 100 concurrent threads

Recursive directory fuzzing

Subdomain & VHost Fuzzing

Subdomain enumeration

Virtual host (vhost) fuzzing

Vhost fuzzing filtering by size

Parameter & Value Fuzzing

Fuzz GET parameter names

Fuzz GET parameter values (IDOR)

POST parameter fuzzing (username enum)

Password brute force via POST

Fuzz with authentication cookie

Authentication & Headers

Fuzz with Bearer token

Fuzz with session cookie

Set cookies via -b flag

Proxy through Burp Suite

Output & Advanced

Save output as JSON

Save output as HTML report

Auto-calibrate filter (smart baseline)

Limit requests per second

Multi-wordlist fuzzing with named positions

Pivoting & Tunneling

Pivot into internal networks — Ligolo-ng, Chisel, SSH local/remote/dynamic forwards & ProxyJump, proxychains, Metasploit autoroute/socks, socat/netcat relays and native Windows netsh/plink forwarding.

Network Pentest

25 cmds

Ligolo-ng

Start the Ligolo-ng proxy on your attack box

Run the agent on the pivot (Linux or agent.exe)

Route the internal subnet through the ligolo interface

Pick the agent session and start the tunnel

Reverse port-forward to catch shells from internal hosts

Chisel

Start the Chisel server (reverse mode) on the attacker

Reverse SOCKS proxy from the pivot back to you

Reverse single-port forward (e.g. RDP)

Local forward to an internal host through the pivot

SSH Tunneling

Dynamic SOCKS proxy through SSH

Local port forward to an internal service

Reverse forward — expose a pivot-local service to you

ProxyJump straight to an internal host

proxychains (use the SOCKS)

Point proxychains at your SOCKS tunnel

TCP-connect scan through the proxy (no SYN over SOCKS)

Run AD tooling across the internal subnet

RDP through the tunnel

Metasploit / Meterpreter

Add a Meterpreter route to the internal subnet

Forward an internal port to your localhost

Expose the routes as a SOCKS proxy for proxychains

socat / netcat Relays

Simple TCP relay through a Linux pivot

Netcat relay without -e

Windows-Side Forwarding

Native Windows port forward — nothing to upload

SSH reverse tunnel from Windows (plink)

Run the Chisel client on Windows

AWS CLI — Cloud Penetration Testing

AWS CLI commands for cloud penetration testing: IAM enumeration, S3 attacks, EC2 SSRF, privilege escalation.

Cloud Pentest

33 cmds

Setup & Enumeration

Configure AWS credentials (access key, secret, region)

Identify current AWS identity (who am I)

Get current IAM user details

List all IAM users

List all IAM groups

List all IAM roles

List custom IAM policies

List policies attached to user

Get inline policy for user

List access keys for user

S3 Attacks

List all accessible S3 buckets

List contents of bucket

List all files recursively

Download file from S3

Sync entire bucket locally

Get bucket ACL (check for public access)

Get bucket policy

List all bucket names only

Test write access to bucket

EC2 & SSRF/IMDS

Access EC2 IMDS metadata (from within EC2)

List IAM roles attached to EC2

Steal temporary credentials from IMDS

List all EC2 instances with IPs

Enumerate security groups (firewall rules)

List EBS snapshots (look for exposed data)

IAM Privilege Escalation

Attach AdministratorAccess policy to user

Overwrite policy with admin permissions

Create new access key for user

Assume an IAM role (lateral movement)

List Lambda functions

List Secrets Manager secrets

Read secret value

Read decrypted SSM parameter

Windows Privilege Escalation

Manual Windows privilege escalation — enumeration, token/Potato attacks (PrintSpoofer/GodPotato), service misconfigurations, AlwaysInstallElevated, credential hunting, UAC bypasses, kernel exploits and scheduled-task/autorun hijacks.

Privilege Escalation

27 cmds

Enumeration

Groups + privileges + integrity level in one shot

List token privileges (look for SeImpersonate/SeBackup/SeDebug)

OS build + installed patches (feed to wesng/watson)

Local users and who is admin

PowerUp automated misconfig checks

Token Privileges (Potato)

SeImpersonate → SYSTEM via the spooler named pipe

Modern SeImpersonate→SYSTEM (DCOM/RPC)

SeImpersonate→SYSTEM on older builds

Dump SAM/SYSTEM with backup rights

Service Misconfigurations

Find unquoted service paths

Find services your user can modify

Hijack a weak-permission service binPath

DLL/binary hijack of a service

Registry & AlwaysInstallElevated

If 1 (both hives) → install a SYSTEM MSI

Run the malicious MSI (AlwaysInstallElevated)

Autologon credentials in the registry

Credential Hunting

Reuse stored credentials without knowing them

Grep the filesystem for passwords

Deployment files often hold local-admin creds

MS14-025 — decryptable domain creds

UAC Bypass & Kernel

Elevate from a medium-integrity admin without a prompt

Alternate auto-elevate bypasses

Map missing patches to kernel exploits

Spooler RCE/LPE

Scheduled Tasks & Autoruns

Find tasks running as a higher-priv user

Hijack a scheduled-task executable

Enumerate all autostart entries (Sysinternals)

Active Directory Enumeration

Enumerate Active Directory — ldapsearch/ldapdomaindump/windapsearch, PowerView, built-in net/nltest/setspn, rpcclient/enum4linux null sessions and RID brute, plus BloodHound/Certipy collection references.

Active Directory

22 cmds

ldapsearch (Linux)

Authenticated LDAP dump of the whole domain

Anonymous — grab naming contexts / base DN

Find Kerberoastable accounts via LDAP

Dump users/groups/computers to HTML + JSON

Quick Domain Admins enumeration

PowerView (Windows)

Enumerate users (catch passwords in descriptions)

List members of a privileged group

Find servers by operating system

Where does the current user have local admin?

Hunt where privileged users are currently logged in

Find abusable ACLs (GenericAll / WriteDacl / etc.)

Enumerate domain and forest trusts

Built-in (net / nltest)

Living-off-the-land user/group enumeration

Password policy + lockout threshold (plan spraying)

List DCs and trusts

Enumerate SPNs (Kerberoasting targets)

rpcclient / enum4linux

All-in-one SMB / RPC / LDAP enumeration

Null-session RPC connection

List domain users + descriptions over RPC

RID-cycle users when LDAP is locked down

Graph & Cert Enum (refs)

Collect graph data from Linux (see the BloodHound sheet)

Enumerate AD CS misconfigurations (see the Certipy sheet)

Frida — Dynamic Instrumentation & Hooking

Frida dynamic instrumentation toolkit for hooking, bypassing, and analyzing mobile and desktop apps.

Mobile Pentest

24 cmds

Setup & Connection

Install Frida CLI tools

List connected devices

List processes on USB device

List processes on remote device

Start frida-server on device (run on device via adb shell)

Deploy and start frida-server on Android

Attach & Spawn

Attach to running app with script (USB)

Spawn (launch) app with script from start

Attach via remote Frida server

Attach interactively (REPL mode)

Trace all calls to open() function

Trace iOS NSURLSession network calls

Common Hook Scripts

Bypass SSL pinning (Conscrypt TrustManager)

Bypass root detection — override isRooted()

Hook Android Activity lifecycle

Hook native libc open() calls

Hook crypto function and log decrypted output

objection (Frida wrapper)

Launch objection REPL against app

Disable SSL pinning (inside objection)

Bypass root detection (inside objection)

List all loaded classes

List methods of a class

Hook all methods in a class

Dump app memory

Linux Privilege Escalation

Manual Linux privilege escalation — enumeration, SUID/SGID/capabilities, sudo abuse (GTFOBins/LD_PRELOAD/Baron Samedit), cron/PATH/wildcard, kernel exploits (PwnKit/DirtyPipe/nf_tables), credential hunting and NFS/Docker/LXD group abuse.

Privilege Escalation

31 cmds

Enumeration

First four checks: who am I, what can I sudo, kernel + distro

Running processes + listening ports (internal services)

Scheduled jobs that may run as root

Watch processes/cron in real time without root

Writable directories (drop payloads / hijack)

SUID / SGID / Capabilities

Find SUID binaries (run as the file owner)

Find SGID binaries

List file capabilities (cap_setuid is gold)

Abuse a binary with cap_setuid+ep

Look up the exact SUID/sudo escape

Sudo Abuse

List what the current user may run as root

GTFOBins-style sudo escape via find

Shell out of a sudo-allowed editor

Abuse env_keep+=LD_PRELOAD with a malicious .so

Baron Samedit (CVE-2021-3156) heap overflow

Cron / PATH / Wildcard

Hijack a root-run cron script

PATH hijacking

Wildcard injection: tar --checkpoint-action=exec

Payload for a writable root cron job

Kernel & Known Exploits

Match the kernel version to a public exploit

Local root on almost any Polkit system (2021)

Overwrite read-only files (5.8–5.16 kernels)

Recent universal LPE (netfilter)

Credentials & Files

Hunt creds in config/source

SSH keys + shell history often leak access

If /etc/passwd is writable, add a UID-0 user

Locate private keys / KeePass DBs

NFS / Docker / Group Abuse

NFS no_root_squash → root file write

Docker group = root (mount host /)

LXD group privesc

Detect a container + check capabilities for escape

Insecure Deserialization

Insecure deserialization across languages — stream fingerprinting, Java ysoserial gadget chains, PHP phpggc + manual objects, Python pickle/PyYAML, .NET ysoserial.net (ViewState/BinaryFormatter), Ruby Marshal and Node node-serialize.

Web Pentest

22 cmds

Detection & Magic Bytes

Java serialized object signature

PHP serialized object / array

Python pickle stream

.NET BinaryFormatter stream

Ruby Marshal data

Java — ysoserial

Detect deserialization with a dependency-free DNS callback

Generate a CommonsCollections RCE gadget

BeanUtils gadget (common on Jenkins / Spring apps)

Spring gadget chain

PHP — phpggc & Manual

List every available PHP gadget chain

Generate a Laravel RCE gadget chain

Monolog gadget, base64 output

Hand-craft an object to hit a __wakeup/__destruct gadget

Trigger object instantiation via the phar:// wrapper

Python — pickle / PyYAML

Build a base64 pickle RCE payload via __reduce__

PyYAML RCE via unsafe load / full_load

PyYAML RCE that returns command output

.NET — ysoserial.net

Generate a BinaryFormatter RCE payload

Forge a malicious ASP.NET ViewState (leaked machineKey)

Abuse polymorphic type handling in Json.NET

Ruby / Node

Ruby 2.x–3.x universal deserialization RCE gadget

node-serialize RCE via an IIFE function

Kerbrute & Rubeus — Kerberos Attacks

Kerbrute for username enumeration and password spraying; Rubeus for full Kerberos attack toolkit.

Active Directory

22 cmds

Kerbrute

Enumerate valid usernames via Kerberos pre-auth

Password spray single password against user list

Brute force specific user

Save valid users to file

Spray with 1-second delay (avoid lockout)

Rubeus — Kerberoasting & AS-REP Roasting

Kerberoast all SPNs in domain

Kerberoast specific service account

Kerberoast with RC4 only (opsec-safe)

AS-REP Roast all users without pre-auth

AS-REP Roast in hashcat format

Rubeus — Ticket Attacks

Dump Kerberos tickets from memory (LUID)

Dump TGT tickets

Pass-the-Ticket — inject .kirbi ticket

Pass-the-Ticket from base64 ticket

S4U2Proxy — constrained delegation abuse

Create Golden Ticket

Create Silver Ticket

Harvest TGTs every 30 seconds

Cracking Kerberos Hashes

Crack Kerberoast TGS hashes (RC4)

Crack Kerberoast TGS hashes (AES128)

Crack AS-REP Roast hashes

Crack Kerberoast with John

GitLeaks & Source Code Recon — Secret Discovery

Gitleaks and other tools for finding secrets, credentials, and sensitive data in source code and git history.

Recon

25 cmds

Gitleaks

Scan current git repo for secrets

Scan specific git repository

Scan and save report as JSON

Scan directory without git history

Scan entire git history for secrets

Use custom config/rules file

Git History Recon

List all commits in history

Search all diffs for "password"

Search diffs for common secret patterns

View file at a specific commit

Check stashed changes for secrets

Find commits that touched sensitive file types

Find deleted files in history

truffleHog & Other Tools

truffleHog scan local git repo

truffleHog scan GitHub repo

truffleHog scan filesystem

Find private keys in source code

Find AWS access keys

Find sensitive files by name

Find config files containing secrets

GitHub Dorking (Online)

GitHub search: secrets in org Python files

GitHub: find .env files in org

GitHub: find PEM certificate files

GitHub: find exposed private keys

Google dork: AWS keys on GitHub for org

SearchSploit & ExploitDB — Exploit Discovery

SearchSploit — local ExploitDB search tool for finding and using publicly known exploits.

Exploitation

14 cmds

Searching

Search exploits for Apache 2.4

Search WordPress 5.0 exploits

Search OpenSSH exploits

Search by exploit title only

Search by CVE number (Log4Shell)

Show URL to web version of exploit

Update ExploitDB database

Viewing & Using Exploits

View/examine exploit file

Copy exploit to current directory

Copy exploit by ID

Show full path of exploit

Browse ExploitDB directory structure

Nmap Integration

Search exploits matching Nmap XML scan results

Scan then auto-search exploits for found services

Certipy — AD CS Abuse (ESC1–ESC16)

Active Directory Certificate Services enumeration and abuse with Certipy v5 — ESC1 through ESC16, NTLM relay to AD CS (ESC8/ESC11), shadow credentials, and golden certificates.

Active Directory

36 cmds

Enumeration & Discovery

Enumerate CAs, templates and ACLs — dumps JSON/TXT report

Show only vulnerable templates (ESC findings) on stdout

Only enabled AND vulnerable templates (real attack surface)

Pass-the-hash enum + BloodHound output for graphing

Force both text and JSON output of the AD CS layout

ESC1 — SAN Impersonation

Request a cert for the template, supplying Administrator UPN in the SAN

Add both UPN and DNS SAN (impersonate a machine/DC)

Embed target SID (required when StrongCertificateBindingEnforcement is on)

ESC2 / ESC3 — Any-Purpose & Enrollment Agent

ESC2 — Any-Purpose EKU template: request, then auth as anyone

ESC3 step 1 — obtain a Certificate Request Agent (enrollment agent) cert

ESC3 step 2 — use the agent cert to enroll on behalf of a target

ESC4 — Template ACL Abuse

You have write rights on the template → overwrite it into an ESC1-able config (saves original)

Now exploit the reconfigured template exactly like ESC1

Restore the template to its original configuration (clean up!)

ESC6 / ESC9 / ESC10 — SAN & Mapping Flaws

ESC6 — CA has EDITF_ATTRIBUTESUBJECTALTNAME2: any template honours an attacker SAN

ESC9/10 step 1 — set a controlled user UPN to the target (needs GenericWrite)

ESC9/10 step 2 — request a cert as victim (template lacks SID security extension)

ESC9/10 step 3 — restore the original UPN, then auth with the cert

ESC7 — CA ACL (ManageCA / ManageCertificates)

Grant yourself the "officer" (ManageCertificates) right on the CA

Enable the SubCA template so it can be requested

Approve a pending (failed) certificate request by its ID

Retrieve the now-issued certificate after manual approval

ESC8 / ESC11 — NTLM Relay to AD CS

ESC8 — relay coerced machine auth to the AD CS HTTP web-enrollment endpoint

ESC11 — relay to the CA RPC interface (ICertPassage) when packets are unsigned

Trigger machine auth toward your relay (PetitPotam / PrinterBug / DFSCoerce)

ESC13 / ESC15 / ESC16 — Policy & CA-Wide Flaws

ESC13 — template with an issuance policy linked to a privileged group (OID group link)

ESC15 (EKUwu / CVE-2024-49019) — inject app policies into a v1 schema template

ESC16 — CA has the SID security extension disabled domain-wide: pair with a UPN swap like ESC9

Authenticate & UnPAC-the-Hash

PKINIT with the cert → get a TGT (.ccache) AND the account NT hash

Disambiguate the identity when the cert has multiple SANs

Authenticate over LDAP (Schannel) and drop into an interactive LDAP shell

Use the recovered TGT for a SYSTEM shell (pass-the-ticket)

Shadow Credentials & Golden Certificate

Shadow Credentials — add a Key Credential, auth, recover the NT hash, then clean up

Steal the CA private key + cert (requires CA-admin / DA) — basis for a Golden Certificate

GOLDEN CERTIFICATE — forge an auth cert for any user with the stolen CA key (offline)

Split a .pfx into separate cert and key files (for use with other tools)

File Upload Bypass

Bypass file-upload restrictions to reach RCE/XSS — extension and MIME/magic-byte tricks, .htaccess/web.config abuse, SVG/HTML/XXE uploads, path traversal and parser/deserialization bugs.

Web Pentest

24 cmds

Extension Tricks

Double extension — misconfigured servers execute the .php

Case variation to dodge a lowercase blacklist

Alternate PHP extension filters often miss

Legacy PHP extension mapping

PHP archive — executed as PHP

Null-byte truncation (old PHP / CGI)

Trailing dot stripped by Windows, leaving .php

IIS semicolon trick — treated as .asp

MIME & Magic Bytes

Spoof the MIME header while uploading a script

GIF magic-byte prefix + PHP payload

Embed PHP in a real image's EXIF comment

JPEG magic bytes to pass content sniffing

Server Config Upload

Upload .htaccess so .jpg runs as PHP (Apache)

Prepend an uploaded "image" as PHP

Upload web.config to enable script exec on IIS

SVG / HTML / XML

Stored XSS via an uploaded SVG

SVG script execution

XXE via an uploaded SVG

HTML upload → stored XSS on the same origin

Path & Overwrite

Path traversal in the filename to control where it lands

Extraction path traversal via a crafted archive

Overwrite a sensitive file by reusing its name

Parser & Deserialization

Trigger PHAR deserialization on a later file operation

Image-parser RCE (ImageTragick-class bugs)

NoSQL Injection

NoSQL injection (MongoDB-focused) — authentication bypass with operators, query operator injection, blind regex extraction, server-side $where JavaScript injection, JSON vs form delivery, and NoSQLMap/ffuf tooling.

Web Pentest

23 cmds

Authentication Bypass

Operator injection — "not equal to null" matches any password

Log in as the first user when both fields are bypassed

Greater-than-empty matches any set password

Form/URL-encoded operator injection

Regex-match the username, bypass the password

Query Operator Injection

Match anything that is not null

Range operators to match populated fields

Match any value from a list

Filter on field presence

Wildcard regex match

Blind Extraction (Regex Oracle)

Confirm the first character, then iterate the alphabet

Character-by-character extraction of a secret field

Boolean oracle drives blind NoSQLi

JavaScript Injection ($where)

Run server-side JavaScript inside the query

Time-based blind via $where

Break out of a string into the $where JS context

Arbitrary JS predicate

Encoding & Delivery

Send real operator objects (not strings) in a JSON body

Express/PHP parse bracket params into nested operators

Operator injection through query-string bracket notation

Tooling

Automated MongoDB / NoSQL injection + enumeration

Fuzz operator names into bracket parameters

Manual operator injection in Repeater

XSS — Cross-Site Scripting Payloads

Cross-site scripting payloads — basic probes, attribute/context breakout, filter & WAF bypasses, DOM sinks, cookie exfiltration, polyglots and framework (Angular CSTI) injection.

Web Pentest

29 cmds

Basic Probes

Simplest XSS probe

Confirm the execution origin

Break out of an attribute, then inject

No <script> needed — image error handler

SVG onload — short and reliable

Body load handler

Attribute & Context Breakout

Inject an event handler inside an attribute

Break a single-quote attribute, then SVG

Auto-trigger via autofocus + onfocus

Escape a <textarea> context

Break out of an inline JS string context

Filter / WAF Bypass

Mixed case to dodge tag/attribute filters

Backticks instead of parentheses

HTML-entity-encoded parentheses

Nested tags survive naive tag stripping

Base64 payload via atob + eval

javascript: URI inside an iframe

DOM-Based Sinks

location.hash flowing into innerHTML

href / location assignment sink

User-triggered DOM execution

Reflected into a DOM sink after breakout

Cookie Theft / Exfiltration

Exfil cookies via an image request

Exfil via fetch

Beacon exfil (fires even on unload)

Cookie exfil without a <script> tag

Polyglots & Framework Injection

0xsobky all-context XSS polyglot

AngularJS client-side template injection

AngularJS CSTI variant

Newer event handler (filter gaps)

Race Conditions

Race-condition exploitation — limit-overrun targets, Burp single-packet attack, Turbo Intruder gating, parallel curl/GNU-parallel bursts, plus how to confirm and mitigate (idempotency, locks).

Web Pentest

12 cmds

Targets (Limit Overrun)

Use a one-time resource multiple times via concurrency

Double-spend before the balance updates

Beat uniqueness checks with parallel requests

Burp — Single-Packet Attack

Fire all requests together (single-packet attack, HTTP/2)

Last-byte sync to minimise network jitter

Turbo Intruder

Queue N requests behind a gate

Release all gated requests at the same instant

Use the bundled single-packet race template

curl / parallel

Fire 30 parallel requests with xargs

GNU parallel burst

Confirm & Mitigate

How to confirm a successful race

Defensive notes

IDOR & Broken Access Control

Insecure Direct Object Reference and broken access control — ID tampering, mass assignment, verb abuse, encoded references, BFLA function-level access and Autorize/Arjun tooling.

Web Pentest

19 cmds

Finding IDOR

Increment/decrement object IDs to reach others' data

Tamper an ID in the query string

Compare the self route with a direct-ID route

Fuzz IDs and flag 200 responses

Parameter & Body Tampering

Swap the user id in a JSON body

Mass assignment — add privileged fields the API trusts

Duplicate parameter — some parsers honour the last (or first)

Wrap the id in an array to bypass type checks

HTTP Verb / Method

Write or modify via an unprotected verb

Smuggle a privileged method past verb-based rules

Indirect / Encoded References

Decode, change, then re-encode object references

Change the subject when the API trusts the token id

Guess hashed identifiers derived from sequential values

BFLA — Function-Level

Reach admin functions directly (Broken Function-Level Authz)

Invoke privileged actions against other users

Guess hidden privileged endpoints

Bypass Tricks & Tooling

Dodge naive route-based access rules

Auto-compare low-priv vs high-priv responses on every request

Discover hidden parameters that may be IDOR-able

Coercion & mitm6 — Forced Authentication

Force machine accounts to authenticate to you and relay it — PetitPotam, PrinterBug, DFSCoerce, ShadowCoerce, Coercer and mitm6, paired with ntlmrelayx / Certipy relay (RBCD, Shadow Credentials, ESC8).

Active Directory

20 cmds

mitm6 — IPv6 DNS Takeover

Spoof DHCPv6 to become the network's IPv6 DNS server (WPAD/auth capture)

Only answer FQDN queries for the target domain — quieter, less breakage

Restrict spoofing to a single victim host (targeted)

Relay the IPv6/WPAD-captured machine auth to LDAPS → configure RBCD

Relay → add a new computer account (then use it for RBCD)

PetitPotam — MS-EFSRPC

Unauthenticated EFSRPC coercion (unpatched DCs) — listener then target

Authenticated coercion (patched DCs require valid creds)

Try an alternate named pipe if efsrpc is filtered

PrinterBug — MS-RPRN (Spooler)

Abuse the Print Spooler RPC to coerce the target to auth to your listener

Alternative SpoolSample/PrinterBug trigger

Check whether the MS-RPRN (Spooler) interface is exposed first

DFSCoerce / ShadowCoerce

MS-DFSNM coercion — works even when the Spooler is disabled

MS-FSRVP (VSS) coercion — another no-Spooler path

Coercer — All-in-One

Enumerate which coercion methods/pipes the target actually exposes

Fire every available coercion method at the target at once

Trigger one specific RPC method only

Relay Combos (where the coerced auth goes)

Relay coerced machine auth to LDAPS → grant RBCD over the victim computer

Relay → add Shadow Credentials (msDS-KeyCredentialLink) on the DC

ESC8 — relay coerced DC$ auth to AD CS web enrollment to mint a DC cert

Relay to SMB and stash the session in a SOCKS proxy for reuse

Nikto — Web Vulnerability Scanner

Nikto web server scanner — checks for dangerous files, outdated software, and server misconfigurations.

Web Pentest

18 cmds

Basic Scanning

Basic scan against target

Scan multiple ports

Force SSL/HTTPS scanning

Full tuning (all checks)

Interesting file/seen in logs only

Misconfiguration checks

XSS checks

Command injection checks

Authentication & Proxy

HTTP Basic Auth credentials

Route through Burp proxy

Include session cookie

Output & Evasion

Save output as HTML report

Save as CSV

Save as XML

IDS evasion: random URI encoding

IDS evasion: directory self-reference /./

IDS evasion: Windows directory separator

Add 1 second delay between requests

JWT Attacks

JSON Web Token attacks — decoding, alg=none, weak-secret cracking (hashcat/jwt_tool), RS256→HS256 key confusion, claim tampering and kid/jku/x5u header injection.

Web Pentest

16 cmds

Recon & Decode

Decode header + payload without verifying

Parse and display a token with jwt_tool

Interactive tamper mode

alg=none Bypass

Forge a token with alg=none (strip the signature)

Manual alg=none — note the trailing dot, empty signature

Weak Secret Cracking

Crack an HS256 signing secret offline

Dictionary-crack the HMAC secret with jwt_tool

Crack the secret with John

Key Confusion (RS256 -> HS256)

Sign with the RSA public key as the HMAC secret (alg confusion)

Recover the server public key for the confusion attack

Claim Tampering

Escalate by editing privilege claims, then re-sign

Inject a claim and re-sign with a known secret

Header Injection (kid / jku / x5u)

kid path traversal → sign with an empty/known key

kid SQL injection to control the verification key

jku/x5u header → point verification at your JWKS

Run all tests against a live endpoint

Metasploit Framework — Exploitation

Metasploit Framework — the world's most used penetration testing framework for exploit development and execution.

Exploitation

48 cmds

msfconsole Basics

Launch Metasploit console

Launch quietly (no banner)

Initialize database then launch

Search for Windows SMB exploits

Search by CVE number

Select EternalBlue exploit

Show info about selected module

Show required options for module

List compatible payloads

Set target host

Set attacker IP (for reverse shells)

Set listener port

Set Meterpreter payload

Execute the exploit

Check if target is vulnerable (non-intrusive)

Meterpreter Commands

Get system information

Get current user

Get current process ID

List running processes

Migrate to process ID 1234

Drop to OS shell

Upload file to target

Download file from target

Dump local NTLM password hashes

Attempt privilege escalation to SYSTEM

Smart hashdump post module

Find local privilege escalation exploits

Background current session

List all active sessions

Interact with session 1

Start/dump keylogger

Live screen sharing from target

Port forward RDP through Meterpreter

Enable RDP on Windows target

Auxiliary Modules

TCP port scanner

Scan for EternalBlue vulnerability

SSH brute force login

HTTP directory scanner

Find VNC with no auth required

FTP brute force

Capture NTLM hashes over HTTP

Post-Exploitation & Persistence

Collect all credentials on Windows

Collect environment variables

Add persistence via scheduled task

Load Mimikatz (kiwi) extension

Dump all credentials via kiwi

Dump SAM database via kiwi

Dump LSA secrets via kiwi

Command Injection

OS command injection — separators and substitution, blind/time-based detection, OOB exfiltration, space/keyword/WAF bypasses, reverse shells and Windows command injection.

Web Pentest

29 cmds

Separators

Chain a second command (semicolon)

Pipe into the injected command

Run only if the first command fails

Background separator (also Windows)

Run if the first command succeeds

Backtick command substitution

Modern command substitution

URL-encoded newline as a separator

Blind / Time-Based

Confirm blind injection via a delay (Unix)

Time delay via substitution

Unix delay via ping

Windows delay via ping

Out-of-Band Exfil

Exfil command output via an HTTP callback

DNS exfil of command output

POST a file to your listener

Base64 the output to survive URL/DNS rules

Space & Keyword Bypass

${IFS} substitutes for a blocked space

Brace expansion avoids spaces

Input redirection instead of a space

Empty quotes break keyword matching

Glob wildcards avoid literal binary names

Base64-decode then execute

Reverse Shells

Bash reverse shell

Netcat reverse shell

Netcat (no -e) FIFO reverse shell

Windows

Windows command separator

Download + execute a payload (certutil)

Run an encoded PowerShell command

PowerShell download-cradle

XXE — XML External Entity

XML External Entity attacks — local file read, SSRF, PHP filter/expect wrappers, blind & error-based out-of-band exfiltration via external DTDs, XInclude, SVG/Office documents and entity-expansion DoS.

Web Pentest

15 cmds

Basic File Read

Read a local file via an external entity

Windows local file read

Directory listing on some Java parsers

SSRF via XXE

Reach cloud metadata through XXE

Hit an internal-only service

PHP Wrappers

Base64-wrap to read files with special chars (PHP)

Read application PHP source code

Command exec if the PHP expect wrapper is enabled

Blind / Out-of-Band

Load an external DTD for out-of-band exfil

External DTD that exfiltrates a file over HTTP

Leak file contents inside a parser error message

Other Vectors

XInclude — works when you cannot control the DOCTYPE

XXE through an uploaded SVG

XXE via Office Open XML documents

Billion Laughs entity-expansion DoS

SQL Injection — Manual Payloads

Hand-built SQL injection payloads — auth bypass, UNION extraction, schema enum, error/blind/time-based, stacked-query RCE and WAF bypasses across MySQL, MSSQL, PostgreSQL and Oracle.

Web Pentest

38 cmds

Detection & Auth Bypass

Classic always-true authentication bypass

Comment out the rest of the query

Log in as a known user, comment the password check

Break out of a double-quote + parenthesis context

MySQL hash-comment variant

URL-friendly always-true

UNION-Based Extraction

Find the column count (increment until it errors)

Match the column count with NULLs

Identify which columns are reflected

Leak DB version (MySQL/MSSQL)

Dump credentials

Concatenate all creds into one row (MySQL)

Schema Enumeration

List all tables

List columns of a table

List databases (MySQL)

Oracle version banner

List tables (PostgreSQL)

Error-Based

MySQL error-based leak (extractvalue)

MySQL error-based leak (updatexml)

MSSQL error-based type-cast leak

PostgreSQL error-based cast leak

Blind — Boolean & Time

Boolean TRUE baseline

Boolean FALSE baseline (diff the responses)

Extract data one character at a time

MySQL time-based delay

MySQL conditional time delay

MSSQL time-based delay

PostgreSQL time-based delay

Stacked Queries & RCE

Enable xp_cmdshell on MSSQL

Run an OS command via MSSQL

PostgreSQL command exec via COPY TO PROGRAM

MySQL write a webshell (needs FILE priv + writable path)

WAF / Filter Bypass

MySQL versioned-comment keyword bypass

Mixed-case keyword bypass

Inline comments instead of spaces

Tab (%09) used as whitespace

ALL keyword to dodge "UNION SELECT" signatures

Double URL-encoded ' OR 1=1

GraphQL Attacks

GraphQL security testing — endpoint discovery and engine fingerprinting, introspection (and recovery when disabled), IDOR/authz via nodes & mutations, batching rate-limit bypass, DoS and injection.

Web Pentest

17 cmds

Discovery

Confirm a GraphQL endpoint

Hunt the endpoint + any exposed IDE

Fingerprint the GraphQL engine

Introspection

Full introspection — dump the schema

List all queries and mutations

Inspect a specific type's fields

Recover the schema even when introspection is disabled

Authz / IDOR

IDOR via a node argument

Authz bypass / mass assignment via a mutation

Relay global-id IDOR (base64 of type:id)

Rate-Limit Bypass (Batching)

Alias many attempts in ONE request to beat rate limits

Array/JSON batching — send many operations at once

DoS

Deeply nested / circular query to exhaust resources

Field-duplication / alias amplification

Injection & Tooling

SQL/NoSQL injection through a GraphQL argument

Tooling — schema parsing, security audit, batching attacks

Automated GraphQL misconfiguration checks

SSRF — Server-Side Request Forgery

Server-side request forgery payloads — internal targets, cloud metadata (AWS/GCP/Azure), IP-encoding and parser-confusion bypasses, protocol smuggling (gopher/file/dict) and blind/parser-driven SSRF.

Web Pentest

31 cmds

Basic Internal Targets

Loopback — reach services bound to localhost

Redis on localhost (frequently unauthenticated)

Elasticsearch index listing

IPv6 loopback

0.0.0.0 reaches local services on some stacks

userinfo trick — looks external, resolves internal

Cloud Metadata

AWS IMDSv1 — list IAM roles

AWS — fetch the role's temporary credentials

AWS IMDSv2 — PUT here first to get a session token

GCP token (needs header Metadata-Flavor: Google)

Azure IMDS (needs header Metadata: true)

IP Encoding Bypass

127.0.0.1 as a decimal integer

127.0.0.1 in hexadecimal

127.0.0.1 in octal

Short-form loopback

IPv4-mapped IPv6 address

Public DNS name that resolves to 127.0.0.1

Parser Confusion & Redirect

Everything before @ is userinfo; real host is 127.0.0.1

Fragment confuses naive host parsers

Backslash parser inconsistency

Open redirect to bypass allow-lists

Suffix trick against weak allow-list checks

Protocol Smuggling

Read local files when file:// is permitted

Leak process environment (secrets) on Linux

Talk to Memcached via dict://

Smuggle a Redis command via gopher (RCE primitives)

Smuggle SMTP via gopher

Blind SSRF & Parser-Driven

OOB interaction (interactsh / Burp Collaborator) for blind SSRF

Hit your own listener to confirm an outbound request

SVG→PDF/PNG renderer SSRF

XXE-driven SSRF via an external entity