Tool Quick-Reference

Networking & Reconnaissance

pkg-lists/10-networking.list

Nmap

Default scripts, version detection, all ports

$ nmap -sC -sV -p- -oN scan.txt <target>

Default scripts, version detection, all ports

Ncat

Open raw TCP listener (modern Netcat)

$ ncat -lvnp 4444

Open raw TCP listener (modern Netcat)

Masscan

Ultra-fast mass network port discovery

$ sudo masscan -p1-65535 <subnet> --rate=10000

Ultra-fast mass network port discovery

Tcpdump

Command-line network packet capture

$ sudo tcpdump -i eth0 -nn -s0 -w capture.pcap

Command-line network packet capture

Wireshark / TShark

Interactive protocol inspection & analysis

$ wireshark # or: tshark -i any

Interactive protocol inspection & analysis

Socat

Multi-purpose port forwarding / bidirectional relay

$ socat TCP-LISTEN:8080,fork TCP:target:80

Multi-purpose port forwarding / bidirectional relay

ProxyChains

Tunnel TCP traffic through SOCKS proxies

$ proxychains4 nmap -sT -Pn -p80 <target>

Tunnel TCP traffic through SOCKS proxies

Arp-scan

Identify alive hosts on local Ethernet/WiFi

$ sudo arp-scan --localnet

Identify alive hosts on local Ethernet/WiFi

Dnsenum

Comprehensive DNS enumeration & subdomains

$ dnsenum --enum target.com

Comprehensive DNS enumeration & subdomains

Hping3

Custom TCP/IP packet assembler and tester

$ sudo hping3 -S -p 80 -c 5 <target>

Custom TCP/IP packet assembler and tester

RustScan

Ultra-fast port discovery piped directly to Nmap

$ rustscan -a <target> -- -A -sC

Ultra-fast port discovery piped directly to Nmap

Naabu

Fast TCP SYN/CONNECT port scanner (ProjectDiscovery)

$ naabu -host <target> -p -

Fast TCP SYN/CONNECT port scanner (ProjectDiscovery)

Web Application Security

pkg-lists/20-web.list

FFUF

Fast web directory & parameter fuzzing

$ ffuf -u http://target/FUZZ -w /usr/share/wordlists/seclists/Discovery/Web-Content/common.txt

Fast web directory & parameter fuzzing

Gobuster

URI & directory brute-forcing

$ gobuster dir -u http://target -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-directories.txt

URI & directory brute-forcing

WhatWeb

Web technology, server & CMS fingerprinting

$ whatweb -a 3 http://target

Web technology, server & CMS fingerprinting

HTTPie

Clean, colored terminal HTTP client

$ http GET http://target/api/v1 Authorization:"Bearer token"

Clean, colored terminal HTTP client

Password Cracking & Auditing

pkg-lists/40-auditing.list

Hydra

Online network brute-force (SSH/FTP/HTTP)

$ hydra -l admin -P rockyou.txt ssh://target

Online network brute-force (SSH/FTP/HTTP)

Medusa

Modular, parallel network login cracking

$ medusa -h target -u admin -P wordlist.txt -M rdp

Modular, parallel network login cracking

John the Ripper

Offline password & shadow hash cracker

$ john --wordlist=rockyou.txt hashes.txt

Offline password & shadow hash cracker

Hashcat

GPU-accelerated hash cracking (-m 1000 = NTLM)

$ hashcat -m 1000 -a 0 ntlm_hashes.txt rockyou.txt

GPU-accelerated hash cracking (-m 1000 = NTLM)

Reverse Engineering & Forensics

pkg-lists/30-forensics.list

Radare2

Command-line reverse engineering & disassembler

$ r2 -d ./binary # then: aaa -> pdf @main

Command-line reverse engineering & disassembler

GDB

The GNU dynamic debugger

$ gdb -q ./binary # then: r, b *main

The GNU dynamic debugger

Binwalk

Analyze and extract embedded files / firmware

$ binwalk -e firmware.bin

Analyze and extract embedded files / firmware

Foremost

File carving based on headers and footers

$ foremost -i image.dd -o /tmp/recovered/

File carving based on headers and footers

ExifTool

Inspect and extract file metadata

$ exiftool image.jpg

Inspect and extract file metadata

TestDisk

Partition repair and deleted file recovery

$ sudo testdisk # or: sudo photorec

Partition repair and deleted file recovery

Hexedit

Direct hexadecimal editor

$ hexedit binary_file

Direct hexadecimal editor

Wireless Security

pkg-lists/50-wireless.list

Aircrack-ng

802.11 monitor mode, capture, and WPA-PSK key cracking

$ sudo airmon-ng start wlan0 && sudo airodump-ng wlan0mon

802.11 monitor mode, capture, and WPA-PSK key cracking

Kismet

Passive wireless device and packet sniffer

$ kismet # then open http://localhost:2501

Passive wireless device and packet sniffer

Reaver

WPS brute-force assessment

$ sudo reaver -i wlan0mon -b <BSSID> -vv

WPS brute-force assessment

Isolated Python Pentest Tools

pipx-lists/pipx-tools.list

NetExec (nxc)

Modern Active Directory & network execution tool

$ nxc smb 192.168.1.0/24 -u user -p pass

Modern Active Directory & network execution tool

Impacket

Network protocol testing suite (70 tools: secretsdump, psexec, wmiexec)

$ impacket-secretsdump domain/user:pass@target

Network protocol testing suite (70 tools: secretsdump, psexec, wmiexec)

Certipy

Active Directory Certificate Services (AD CS) auditing

$ certipy find -vulnerable -u user@domain -p pass

Active Directory Certificate Services (AD CS) auditing

SQLmap

Automated SQL injection & database takeover

$ sqlmap -u "http://target/page.php?id=1" --batch --dbs

Automated SQL injection & database takeover

Mitmproxy

SSL/TLS intercepting HTTP proxy

$ mitmproxy # interactive TUI on port 8080

SSL/TLS intercepting HTTP proxy

Arjun

HTTP parameter discovery suite

$ arjun -u http://target/api/endpoint -m GET

HTTP parameter discovery suite

Dirsearch

Advanced recursive web path brute-forcer

$ dirsearch -u http://target -e php,html,js

Advanced recursive web path brute-forcer

Updog

Instant HTTP/S file transfer server with uploads

$ updog -p 9090 -d /path/to/share

Instant HTTP/S file transfer server with uploads

Sublist3r

OSINT subdomain discovery

$ sublist3r -d domain.com

OSINT subdomain discovery

Upstreams & Enterprise Suites

upstreams/

Metasploit

Full Metasploit penetration testing framework

$ msfconsole

Full Metasploit penetration testing framework

Burp Suite

Burp Suite Community Edition proxy & scanner

$ burpsuite # GUI

Burp Suite Community Edition proxy & scanner

OWASP ZAP

Zed Attack Proxy web vulnerability suite

$ zap # GUI via Flatpak

Zed Attack Proxy web vulnerability suite

Evil-WinRM

Windows Remote Management shell

$ evil-winrm -i target_ip -u Administrator -p pass

Windows Remote Management shell

Responder

LLMNR / NBT-NS / mDNS poisoning & hash capture

$ sudo responder -I eth0 -dwv

LLMNR / NBT-NS / mDNS poisoning & hash capture

SecLists

Massive collection of wordlists, payloads, usernames

$ /usr/share/wordlists/seclists/

Massive collection of wordlists, payloads, usernames

DevTunnel

Secure port forwarding to expose local ports publicly

$ devtunnel host -p 8000

Secure port forwarding to expose local ports publicly

Web Dashboards & Container Stacks

upstreams/ & 60-docker.list

Portainer CE

Container management UI (admin; setup token in /opt/portainer/admin_setup.txt)

$ https://localhost:7999

Container management UI (admin; setup token in /opt/portainer/admin_setup.txt)

SysReptor

Pentest reporting platform (user reptor; password in /opt/sysreptor/admin_credentials.txt)

$ http://localhost:8000

Pentest reporting platform (user reptor; password in /opt/sysreptor/admin_credentials.txt)

BloodHound CE

AD attack-path mapping (user admin; password in /opt/bloodhound/admin_credentials.txt)

$ http://localhost:8080