NetExec
A practical NetExec guide: install it, verify it, enumerate one protocol at a time, validate credentials without locking accounts, read the output honestly, and keep a cheat sheet you will actually reuse.
Tagged “Enumeration”
32 entries tagged “Enumeration”. Browse all tags
All entries
enum4linux-ng
The enum4linux-ng quick reference: the flags that matter, a modular copy-paste cheat sheet, and a worked breakdown of every real SMB and RPC situation. List shares anonymously, enumerate users and groups, dump the password policy, RID-cycle when direct enum is blocked, add credentials for depth, and export clean JSON or YAML.
Nikto
The Nikto quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real scan. Scan HTTP and HTTPS, hit odd ports, reach a vhost by Host header, tune out the noise, proxy through Burp, save a machine-readable report, and pull just the findings.
dirsearch
The dirsearch quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real content-discovery task. Pick a wordlist, append extensions, filter soft-404s by size, recurse into found directories, scan a list of hosts, save JSON, and proxy through Burp.
dig
The dig quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Resolve A/AAAA, find MX and NS, read SPF and DMARC TXT, reverse-lookup an IP, query a specific resolver, trace delegation from the root, and test a zone transfer.
ldapsearch
The ldapsearch quick reference: the flags, a modular copy-paste cheat sheet, and a worked breakdown of every real task. Find the base DN from the Root DSE, bind anonymously or with credentials, list users and groups, enumerate computers, hunt Kerberoastable accounts, page past a size limit, and query over LDAPS.
dnsenum
The dnsenum quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Pull records and name servers, test a zone transfer, brute force subdomains, pick a resolver for split-horizon DNS, sweep netranges, grow a wordlist, and export XML for your notes.
feroxbuster
The feroxbuster quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Run recursive content discovery, cap depth, filter soft-404 noise by size or words, add extensions, scan authenticated with a cookie, follow redirects, proxy through Burp, save JSON, and resume an interrupted scan.
PowerView
A practical PowerView guide for authorized AD labs: load the module, enumerate users, groups, ACLs, and trusts from a domain-joined host, read the output, and understand the defenses that watch it.
GDB
The GDB quick reference with GEF and pwndbg: launch flags, a modular cheat sheet, and a worked breakdown of every real situation. Break on a stripped binary, step by instruction, read args in registers, dump the stack, watch a variable, measure an overflow offset with cyclic, inspect the heap, and debug a core dump post-mortem.
WinPEAS
A practical WinPEAS guide: get the Windows privilege-escalation enumerator onto a target, read its color-coded output, focus on the high-signal findings, and avoid drowning in noise.
Wfuzz
The Wfuzz quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Fuzz paths, query and POST parameters, headers, cookies, and virtual hosts, filter custom-404 noise by size, brute a login with two markers, encode payloads on the fly, and proxy through Burp.
Smbmap
The smbmap quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. List shares over a null session, read the READ/WRITE flags honestly, recurse a share, pull and push files, pass the hash, and run an authorized remote command.
RustScan
The RustScan quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Sweep all 65535 TCP ports in seconds, hand the open ones to Nmap for versions and scripts, scan a subnet or a file of hosts, fix too many open files, tune speed on a laggy link, and pull a greppable port list.
Pspy
The pspy quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Transfer the static binary, watch processes and cron fire in real time without root, catch a UID=0 root timer, save and grep the feed for root commands, and turn a writable cron script into a privilege-escalation lead.
PowerUp
A practical PowerUp guide: run the PowerSploit Windows privesc auditor, read its check output honestly, focus on the high-signal service and path findings, and keep it lab-safe.
LinPEAS
The LinPEAS quick reference: the flags that matter, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Deliver the script to a target, run and save a clean no-color report, tune the depth (stealth, all-checks, extra, regex), scope checks by group or MITRE technique, grep the high-signal findings, and read the color legend honestly.
LinEnum
The LinEnum quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Deliver the script to a foothold, run default vs thorough, hunt keywords, export files, write a report, and read the sudo, SUID/SGID, cron, and creds sections that matter.
CeWL
The CeWL quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Crawl an authorized site, build a wordlist from its own words, tune depth and length, harvest emails and document authors, rank by frequency, then feed hydra, john, and hashcat.
BloodHound
A practical BloodHound guide: collect Active Directory graph data, ingest it, hunt attack paths to Domain Admin, and read the output without chasing dead ends.
Nmap
The Nmap quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Ping-sweep a subnet, scan all 65535 ports, fingerprint service versions, run safe NSE scripts, scan UDP, get past a blocked ping, and save output for your notes.
DNSRecon
The DNSRecon quick reference: modes, flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Pull standard records, test a zone transfer, brute force subdomains, reverse an IP range, walk a DNSSEC zone, pin a resolver, and save CSV/JSON you can diff.
rpcclient
The rpcclient quick reference: connection flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Open a null session, enumerate users, groups, RIDs, and shares, read the password policy, map names to SIDs, RID-cycle, authenticate with an NT hash, and read NT_STATUS errors honestly.
Gobuster
The Gobuster quick reference: modes, flags, a modular cheat sheet, and a worked breakdown of every real task. Brute-force directories and files, discover vhosts and DNS subdomains, filter false positives by status and length, fuzz with the FUZZ keyword, route through Burp, and enumerate open S3 buckets.
Impacket
A practical Impacket guide: install it, verify it, pick the right script, handle credential and hash syntax cleanly, read protocol errors honestly, and keep a cheat sheet you will actually reuse.
smbclient
The smbclient quick reference: flags, a modular cheat sheet, and a worked breakdown of every real situation. List shares over a null session, browse a share interactively, pull one file or a whole tree, pass-the-hash, force an SMB dialect, grab a share as a tar, and debug a refused connection.
WhatWeb
The WhatWeb quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Fingerprint a target, tune aggression, chase redirects to the real app, hit a vhost by Host header, scan a list, proxy through Burp, and save structured JSON.
ffuf
The ffuf quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Fuzz directories and extensions, discover hidden parameters and virtual hosts, fuzz JSON and login bodies, calibrate away catch-all pages, filter by size, words, or regex, recurse, and replay a captured request.
SecLists
The SecLists quick reference: the folders that matter, the file tools and flags you pair with a list, and a modular cheat sheet. Pick a web-content list, brute subdomains, fuzz a vhost, feed ffuf and gobuster, run a gentle Hydra login test, crack hashes offline, and carve a big list into a focused slice.
Amass
The Amass quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real recon situation. Enumerate subdomains passively then actively, load API keys for real coverage, brute force names, pull JSON with jq, find related domains by WHOIS/ASN/CIDR, diff the stored database, and validate before you scan.
DIRB
The DIRB quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real scan. Run a first pass, append extensions, scope one directory, scan behind basic auth, reuse a session cookie, proxy through Burp, and survive a wildcard server.
Linux Strength Training Walkthrough
find/grep filesystem enumeration plus John cracking of GPG-encrypted files and hashes harvests reused credentials for lateral movement across users, then unrestricted sudo grants root.