# h4rithd Pentest Notes > Pentest notes and cheatsheets by h4rithd: port-by-port enumeration, Active Directory, Linux and Windows privesc, shells, pivoting, web and cloud. Practical, command-first notes written by Harith Dilshan (h4rithd), an offensive security engineer (OSCP, CPENT, Hack The Box Grandmaster). Each page below links to a plain Markdown version; the HTML version is the same URL without `.md` and with a trailing slash. Placeholders in commands use a consistent form: `` target IP, `` target port, `` target URL, ``, ``, ``, `` NTLM hash, `` attacker IP, `` listener port. - Full text of every note in one file: https://pentest.h4rithd.com/llms-full.txt - Sitemap: https://pentest.h4rithd.com/sitemap-index.xml ## Port lookup - 21/tcp FTP: https://pentest.h4rithd.com/tcp/21-ftp.md - 22/tcp SSH: https://pentest.h4rithd.com/tcp/22-ssh.md - 25/tcp SMTP: https://pentest.h4rithd.com/tcp/25-smtp.md - 53/tcp DNS: https://pentest.h4rithd.com/tcp/53-dns.md - 69/udp TFTP: https://pentest.h4rithd.com/udp/69-tftp.md - 79/tcp Finger: https://pentest.h4rithd.com/tcp/79-finger.md - 110/tcp POP3 & IMAP: https://pentest.h4rithd.com/tcp/110-pop3.md - 111/tcp RPC & NFS: https://pentest.h4rithd.com/tcp/2049-nfs.md - 139/tcp SMB: https://pentest.h4rithd.com/tcp/smb-or-445-139.md - 143/tcp POP3 & IMAP: https://pentest.h4rithd.com/tcp/110-pop3.md - 161/udp SNMP: https://pentest.h4rithd.com/udp/161-snmp.md - 389/tcp LDAP: https://pentest.h4rithd.com/tcp/389-ldap.md - 443/tcp HTTPS: https://pentest.h4rithd.com/tcp/443-https.md - 445/tcp SMB: https://pentest.h4rithd.com/tcp/smb-or-445-139.md - 500/udp IPsec IKE: https://pentest.h4rithd.com/udp/500-4500-ipsec-ike.md - 587/tcp SMTP: https://pentest.h4rithd.com/tcp/25-smtp.md - 623/udp IPMI: https://pentest.h4rithd.com/udp/623-ipmi.md - 631/udp IPP: https://pentest.h4rithd.com/udp/ipp-or-631.md - 636/tcp LDAP: https://pentest.h4rithd.com/tcp/389-ldap.md - 993/tcp POP3 & IMAP: https://pentest.h4rithd.com/tcp/110-pop3.md - 1521/tcp Oracle SQL: https://pentest.h4rithd.com/database/oracle.md - 2049/tcp RPC & NFS: https://pentest.h4rithd.com/tcp/2049-nfs.md - 3128/tcp Squid Proxy: https://pentest.h4rithd.com/tcp/3128-squid-proxy.md - 3690/tcp Subversion: https://pentest.h4rithd.com/tcp/3690-subversion.md - 4500/udp IPsec IKE: https://pentest.h4rithd.com/udp/500-4500-ipsec-ike.md - 6379/tcp Redis: https://pentest.h4rithd.com/tcp/redis-or-6379.md - 9200/tcp Elasticsearch: https://pentest.h4rithd.com/tcp/9200-elasticsearch.md - 11211/tcp Memcached: https://pentest.h4rithd.com/tcp/11211-memcached.md - 24007/tcp Gluster: https://pentest.h4rithd.com/tcp/24007-and-49152-gluster.md - 49152/tcp Gluster: https://pentest.h4rithd.com/tcp/24007-and-49152-gluster.md ## Linux - [Linux Lateral Movement](https://pentest.h4rithd.com/linux/basic-commands.md): Common commands used for Linux - [PrivilageEsc Linux](https://pentest.h4rithd.com/linux/privilageesc-linux.md): Linux Privilege Escalation Scripts ## Windows - [Windows Active Directory](https://pentest.h4rithd.com/windows/active-directory-smb.md): Abusing the WriteOwner permission in Active Directory allows an attacker to change the owner of an object, such as a user, group, or computer. Once you own the object, you can then grant yourself FullControl or... - [Windows Lateral Movement](https://pentest.h4rithd.com/windows/basic-commands.md) - [PrivilageEsc Windows](https://pentest.h4rithd.com/windows/privilageesc-windows.md): Check list : https://book.hacktricks.xyz/windows/checklist-windows-privilege-escalation ## LLM SECURITY - [LLM & AI Penetration Testing](https://pentest.h4rithd.com/llm-security/llm-and-ai-penetration-testing.md) ## Mobile Security - [Android](https://pentest.h4rithd.com/mobile-security/mobile-sec.md) ## Cloud - [AWS](https://pentest.h4rithd.com/cloud/aws.md) - [Docker](https://pentest.h4rithd.com/cloud/docker.md) - [Kubernetes](https://pentest.h4rithd.com/cloud/kubernetes.md) - [Entra ID (Azure AD)](https://pentest.h4rithd.com/cloud/azure-ad.md) ## Tools - [File Transfers](https://pentest.h4rithd.com/tools/file-transfers.md) - [Shells / Payloads](https://pentest.h4rithd.com/tools/shells-payloads.md): Here are shells - [Pivoting / Forwarding](https://pentest.h4rithd.com/tools/pivoting-forwarding.md) - [Network Enumeration](https://pentest.h4rithd.com/tools/network-enumeration.md): Ports 1 to 1023 are well-known ports reserved for privileged services, meaning you must be a superuser (root) to bind services to them. Port 0 is treated as a wildcard port and is typically used by applications to... - [Cracking / Fuzzing / Brute-force](https://pentest.h4rithd.com/tools/fuzzing-brute-force.md): Caution: This fucking tool is not good for username/password enumeration because of "Content-Type" header. use wfuzz tool or use -request methord. ## Forensic - [Volatility3](https://pentest.h4rithd.com/forensic/volatility3.md): An advanced memory forensics framework - [Log Analysis](https://pentest.h4rithd.com/forensic/log-analysis.md) ## TCP - [FTP Pentesting (Port 21)](https://pentest.h4rithd.com/tcp/21-ftp.md): Penetration Testing on FTP - [SSH Pentesting (Port 22)](https://pentest.h4rithd.com/tcp/22-ssh.md): SSH (Secure Shell) is a cryptographic protocol for secure remote access and data transfer over TCP port 22, using SSHv2 for security (SSHv1 is insecure); prefer key-based authentication over passwords, disable root... - [SMTP Pentesting (Port 25, 587)](https://pentest.h4rithd.com/tcp/25-smtp.md): Port 25 is the standard SMTP port for server-to-server email relay but is often blocked due to spam abuse; port 587 is the recommended default for secure email submission, while port 465 is a legacy. - [DNS Pentesting (Port 53)](https://pentest.h4rithd.com/tcp/53-dns.md) - [Finger Pentesting (Port 79)](https://pentest.h4rithd.com/tcp/79-finger.md) - [POP3 & IMAP Pentesting (Port 110, 143, 993)](https://pentest.h4rithd.com/tcp/110-pop3.md): By default, IMAP uses port 143 for unencrypted connections and port 993 for secure connections over SSL. Use GUI clients like Evolution. - [RPC & NFS Pentesting (Port 111, 2049)](https://pentest.h4rithd.com/tcp/2049-nfs.md): NFS allows systems to access and share files over a network as if they were local. RPC enables programs to execute functions on remote systems, supporting services like NFS through netw communication - [LDAP Pentesting (Port 389, 636)](https://pentest.h4rithd.com/tcp/389-ldap.md): LDAP typically uses port 389 for unencrypted communication and port 636 for encrypted connections (LDAPS). While 389 is the default for unencrypted LDAP, 636 is the standard for LDAP over SSL/TLS. - [HTTPS Pentesting (Port 443)](https://pentest.h4rithd.com/tcp/443-https.md) - [SMB Pentesting (Port 445, 139)](https://pentest.h4rithd.com/tcp/smb-or-445-139.md): Modern SMB (like SMBv2/v3) typically uses only TCP 445, while older versions (SMBv1) may use 139 and NetBIOS-related ports. - [Squid Proxy Pentesting (Port 3128)](https://pentest.h4rithd.com/tcp/3128-squid-proxy.md) - [Subversion Pentesting (Port 3690)](https://pentest.h4rithd.com/tcp/3690-subversion.md): Subversion (svn server) - [Redis Pentesting (Port 6379)](https://pentest.h4rithd.com/tcp/redis-or-6379.md) - [Elasticsearch Pentesting (Port 9200)](https://pentest.h4rithd.com/tcp/9200-elasticsearch.md) - [Memcached Pentesting (Port 11211)](https://pentest.h4rithd.com/tcp/11211-memcached.md) - [Gluster Pentesting (Port 24007, 49152)](https://pentest.h4rithd.com/tcp/24007-and-49152-gluster.md) ## UDP - [TFTP Pentesting (Port 69)](https://pentest.h4rithd.com/udp/69-tftp.md) - [SNMP Pentesting (Port 161)](https://pentest.h4rithd.com/udp/161-snmp.md): Simple Network Management Protocol is a protocol used to monitor and manage devices on IP networks (routers, switches, servers, printers, etc.) - [IPsec IKE Pentesting (Port 500, 4500)](https://pentest.h4rithd.com/udp/500-4500-ipsec-ike.md) - [IPMI Pentesting (Port 623)](https://pentest.h4rithd.com/udp/623-ipmi.md) - [IPP Pentesting (Port 631)](https://pentest.h4rithd.com/udp/ipp-or-631.md): The Internet Printing Protocol (IPP), as specified in RFC2910 and RFC2911, serves as a foundation for printing over the internet. ## OWASP 10 - [LFI / XXE/XSLT](https://pentest.h4rithd.com/owasp-10/lfi-xxe.md) - [NoSQL Injection](https://pentest.h4rithd.com/owasp-10/nosqli.md) - [SQL Injection](https://pentest.h4rithd.com/owasp-10/sqli.md) - [Neo4j Injection](https://pentest.h4rithd.com/owasp-10/neo4j-injection.md) - [Command Injection](https://pentest.h4rithd.com/owasp-10/command-injection.md) - [Deserialization](https://pentest.h4rithd.com/owasp-10/deserialization.md) - [XSS / CSV / HTMLi / (S/C)SRF / SSTI](https://pentest.h4rithd.com/owasp-10/xss-html-ssti-scsrf.md) ## Database - [SQLite](https://pentest.h4rithd.com/database/sqlite.md) - [Oracle SQL Pentesting (Port 1521)](https://pentest.h4rithd.com/database/oracle.md) - [MSSQL / MYSQL / PSQL](https://pentest.h4rithd.com/database/mssql-mysql.md): SQL / MYSQL cheat sheet ## Binary Exploitation - [Linux](https://pentest.h4rithd.com/binary-exploitation/binary-exploit.md) - [Windows](https://pentest.h4rithd.com/binary-exploitation/windows.md) ## Languages - [Go for Pentesters](https://pentest.h4rithd.com/languages/go.md) - [.Net for Pentesters](https://pentest.h4rithd.com/languages/net.md) - [PHP for Pentesters](https://pentest.h4rithd.com/languages/php.md) - [Perl for Pentesters](https://pentest.h4rithd.com/languages/perl.md) - [asp/x for Pentesters](https://pentest.h4rithd.com/languages/asp-x.md) - [Ruby for Pentesters](https://pentest.h4rithd.com/languages/ruby.md) - [Bash for Pentesters](https://pentest.h4rithd.com/languages/bash.md) - [React for Pentesters](https://pentest.h4rithd.com/languages/react.md) - [Python for Pentesters](https://pentest.h4rithd.com/languages/python.md) - [NGINX for Pentesters](https://pentest.h4rithd.com/languages/nginx.md) - [Node.js for Pentesters](https://pentest.h4rithd.com/languages/node-js.md) ## Other - [Hints!!](https://pentest.h4rithd.com/other/hints.md) - [Git](https://pentest.h4rithd.com/other/git.md) - [WiFi](https://pentest.h4rithd.com/other/wifi.md) - [Curl](https://pentest.h4rithd.com/other/curl.md) - [BookMarks](https://pentest.h4rithd.com/other/bookmarks.md) - [Steganography](https://pentest.h4rithd.com/other/steganography.md) ## CMS / Servers / Others - [Wordpress](https://pentest.h4rithd.com/cms-servers-others/wordpress.md): WordPress is a PHP-based Content Management System (CMS). A standard WordPress installation consists of the WordPress core, themes, plugins, uploads, configuration files, and a MySQL/MariaDB database. - [Servers / Others](https://pentest.h4rithd.com/cms-servers-others/servers.md) ## RedTeam - [Reconnaissance](https://pentest.h4rithd.com/redteam/reconnaissance.md): gathering information to plan future adversary operation. - [Initial Access](https://pentest.h4rithd.com/redteam/initial-access.md) - [Persistence Techniques](https://pentest.h4rithd.com/redteam/persistence-techniques.md) - [AV Evasion Techniques](https://pentest.h4rithd.com/redteam/av-evasion-techniques.md) ## Optional - [Hi,](https://pentest.h4rithd.com/about.md): I am Harith D (aka h4rithd) ! - [Portfolio](https://h4rithd.com): about the author - [Blog](https://blog.h4rithd.com): write-ups