Cheatsheet

# Host discovery only, no port scan

# Every TCP port, fast

# Versions and default scripts on open ports

# Top UDP ports (SNMP, DNS, TFTP)

# Passive subdomains, then probe for live web servers

# Subdomains from Certificate Transparency

# Directory discovery

# Virtual host discovery, filter default size

# Response headers only: server, cookies, security headers

# Official security contact and disclosure policy

# Fingerprint the tech stack

# Paths the site asks crawlers to skip

# List shares with a null session

# Users, groups, shares, and password policy

# Sweep a subnet for anonymous share access

# Find the domain's naming context

# First look at any unknown file

# Metadata: GPS, camera, software, authors

# Find and extract embedded files

# Decode Base64

# Hex dump to check magic bytes

# Guess a hash type before cracking

# Serve the current folder to lab machines

# Record your whole terminal session

# Session that survives disconnects

# Copy an Exploit-DB entry locally to read it

# Listening ports and their processes

# Pull fields from JSON tool output

# Validate a credential and read host and domain info

# Domain users, including description fields

# Domain groups and membership

# Password policy (length, lockout, complexity)

# Accounts trusted for delegation

# Confirm which usernames exist, no login needed

# Enumerate users and descriptions over authenticated LDAP

# Disabled accounts via userAccountControl flags

# Collect relationships for BloodHound path analysis

# Dump the user list with Impacket

# Map share access across the subnet with one credential

# Domain groups over RPC

# Sync your clock to the DC so Kerberos works

# Interfaces and addresses, one line each

# Routing table and default gateway

# Listening sockets and owning processes

# Established TCP connections

# Path to a host without reverse lookups

# Per-hop latency and loss report

# Test the path MTU (1472 + 28 bytes of headers = 1500)

# Is one TCP port reachable?

# Your public IP address

# Watch DNS traffic live

# Capture traffic for one host to a file

# Read back only SYN packets

# HTTP requests from a capture

# Conversation summary by IP

# Most queried domain names

# PowerShell port reachability test

# Listening ports on Windows

# Identify a hash type before cracking

# name-that-hash, with Hashcat and John modes

# Benchmark your hardware's cracking speed

# MD5 hashes against a wordlist

# NTLM hashes with a mutation ruleset

# Linux sha512crypt ($6$) shadow hashes

# bcrypt hashes (slow by design)

# WPA/WPA2 from a captured handshake (your own network)

# Brute force a known password mask

# Show already-cracked hashes from the pot file

# John the Ripper equivalent

# Display cracked results

# Convert an encrypted private key for cracking (keys you own)

# Convert an encrypted archive you are authorized to open

# Serve the current directory over HTTP

# Pull a file onto a Linux target

# Same with curl

# Copy over SSH

# Stand up a quick SMB share for transfers

# Pull from an SMB share on Windows

# Download on Windows with a built-in tool

# Download with PowerShell

# Transfer with netcat when nothing else is available

# Move a file through a text-only channel

# Local forward: reach the target's internal port 80 at localhost:8080

# Remote forward: expose your local port on the target

# Dynamic SOCKS proxy through the host

# Route another tool through the SOCKS proxy

# Transparent VPN-like routing over SSH, no proxychains

# Run a chisel server on your box for reverse tunnels

# Connect back from the target to build a SOCKS tunnel

# Add a route to reach a network over an existing VPN interface

# Handshake and certificate chain

# Decode the server certificate

# Who, issued by whom, and validity

# Hostnames a certificate covers

# Certificate fingerprint

# Does the server accept TLS 1.2?

# Validate a certificate against a chain

# Self-signed lab certificate

# Certificate signing request

# 256 random bits as hex

# SHA-256 of a file

# Encrypt a file with a passphrase

# Extract certificates from a PKCS#12 bundle

# Base64 decode a file

# Kernel and distribution

# Current user, groups, and IDs

# What the current user may run with sudo

# Recent logins

# Who is logged in now

# Process tree

# Running services

# Scheduled systemd timers

# Cron jobs for the user and system

# Recent logs for one service

# Disk usage and the biggest directories

# SUID binaries to review

# Files changed in the last hour

# Open network files per process

# Human user accounts

# Password ageing for an account

# Installed package versions (Debian family)

# Recently installed packages (RHEL family)

# OS version, patches, and domain

# User, groups, and privileges

# OS and domain in PowerShell

# Most recent patches

# Local accounts and admins

# Running services

# Enabled scheduled tasks

# Busiest processes

# Programs that run at startup

# Microsoft Defender status

# Firewall profile state

# Files changed in the last hour

# Hash a file

# Current audit policy

# Top sources of failed SSH logins

# Successful SSH logins

# sudo usage today

# Top client IPs in a web log

# Recent server errors

# Requests that look like injection attempts

# Most requested paths

# Search rotated, compressed logs for one IP

# Errors from JSON logs

# Recent failed Windows logons

# Remote interactive (RDP) logons

# Accounts created

# Recent PowerShell activity

# New services installed

# Record a hash before you analyze anything

# Image a disk

# Partition layout of an image

# List files, including deleted ones

# Mount a partition read only

# Timestamps: access, modify, change, birth

# Identify a file by magic bytes

# UTF-16 strings, common in Windows binaries

# All metadata, grouped by source

# Find and extract embedded files

# Carve files from raw data

# Processes from a memory image (Volatility 3)

# Network connections from memory

# Scan files with YARA rules

# Full history across branches

# Commits that added or removed a string

# Files changed in one commit

# Scan a repository for committed secrets

# Effective git configuration and where it came from

# All containers

# Risky container settings

# Image layers and the commands that built them

# Explore an image with no network

# Known vulnerabilities in an image

# What your Kubernetes identity may do

# Pods in every namespace

# Which secrets exist (names only)

# Which AWS identity you are using

# Policies attached to a user

# Is a bucket publicly listable?

# Bucket policy

# Security groups open to the internet

# Recent API activity

# Current Azure subscription and identity

# Azure role assignments

# Active Google Cloud account and project

# Project IAM bindings

# Broad AWS security posture checks

# Multi-cloud configuration review