Windows Download Methods
The Windows-native ways to pull a file when you have a shell on a Windows host: certutil, bitsadmin, PowerShell Invoke-WebRequest, WebClient, and the in-memory IEX cradle, with an honest look at how defenders see each one.
Tutorials
Step-by-step guides for building practical, hands-on security skills.
Guides
Start-here how-tos for newcomers to hands-on security.
67 entries ExploreLinux
Linux fundamentals, the command line, and system hardening.
Coming soon ExploreWindows
Windows internals, administration, and security essentials.
Coming soon ExploreNetworking
Core networking concepts, protocols, and packet analysis.
Coming soon ExploreProgramming
Scripting and programming for automation and tooling.
Coming soon ExploreVulnerabilities
Common vulnerability classes explained with worked examples.
Coming soon ExploreRecent
SMB File Transfer
Move files to and from a Windows target over SMB: stand up a share with impacket-smbserver, then pull, run, and push back with native copy / net use or smbclient. Quick reference with a modular cheat sheet and per-command breakdowns.
SCP and SSH File Transfer
The scp and sftp quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real transfer. Upload and download, copy a directory with -r, authenticate with a recovered key, hop through a jump host, pipe over ssh when scp is missing, and verify with a checksum.
Netcat File Transfer
The netcat file-transfer quick reference: flags, a modular cheat sheet, and worked breakdowns. Listen and save, connect and send, close cleanly with -N or -q0, stream a directory with tar, encrypt with socat OPENSSL, fall back to bash /dev/tcp when nc is missing, and checksum to catch truncation.
HTTP File Transfer
The HTTP file-transfer quick reference: serve a folder from your attacker box in one line, then pull files onto the target with wget, curl, certutil, PowerShell, or curl.exe. Flags, a modular cheat sheet, in-memory execution, upload-back with updog, checksum verification, and beating egress filters by serving on 80 or 443.
Getting Files onto a Target
The file-transfer quick reference: the serve-and-pull vs push-and-receive decision, a modular copy-paste cheat sheet, and a worked breakdown of every method. Serve a folder over HTTP, pull with wget or certutil, host an SMB share, move a file with netcat or socat, copy over scp, paste a base64 blob, and checksum both ends.
base64 File Transfer
The base64 file-transfer quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Encode a file to one pasteable line, decode it with a heredoc, move files with certutil or PowerShell on Windows, chunk a blob too long to paste, and checksum both ends to prove it arrived intact.
NetExec
A practical NetExec guide: install it, verify it, enumerate one protocol at a time, validate credentials without locking accounts, read the output honestly, and keep a cheat sheet you will actually reuse.
socat
The socat quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Verbose TCP client, port forward, UNIX-socket-to-TCP bridge, TLS wrap, hex-dump a protocol, upgrade a reverse shell to a full PTY, and a virtual serial pair.
whois
The whois quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Look up a domain, find who owns an IP, enumerate a netblock, pull name servers, read registration dates, query a registry directly, and route around a redacted or wrong-server answer with RDAP.
wget
The wget quick reference: install and verify, a modular copy-paste cheat sheet, and one command for every real situation. Resume a broken download, mirror a site for offline viewing, pull a list of URLs, reuse a login cookie, POST a form, and rate-limit to stay quiet.
TShark
The TShark quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Read a PCAP, filter by BPF or display syntax, extract clean fields, follow a TCP stream, pull cleartext creds, carve files out of HTTP, and spot a port scan.
enum4linux-ng
The enum4linux-ng quick reference: the flags that matter, a modular copy-paste cheat sheet, and a worked breakdown of every real SMB and RPC situation. List shares anonymously, enumerate users and groups, dump the password policy, RID-cycle when direct enum is blocked, add credentials for depth, and export clean JSON or YAML.
sqlmap
The sqlmap quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Confirm an injectable parameter, feed a saved Burp request, fingerprint the DBMS, walk the dbs/tables/columns ladder, dump only the columns you need, grab password hashes, evade a WAF with tamper scripts, and route through a proxy.
Nikto
The Nikto quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real scan. Scan HTTP and HTTPS, hit odd ports, reach a vhost by Host header, tune out the noise, proxy through Burp, save a machine-readable report, and pull just the findings.
dirsearch
The dirsearch quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real content-discovery task. Pick a wordlist, append extensions, filter soft-404s by size, recurse into found directories, scan a list of hosts, save JSON, and proxy through Burp.
dig
The dig quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Resolve A/AAAA, find MX and NS, read SPF and DMARC TXT, reverse-lookup an IP, query a specific resolver, trace delegation from the root, and test a zone transfer.
John the Ripper
The John the Ripper quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Identify a hash, convert a ZIP or SSH key with a *2john script, run wordlist and rule attacks, crack NT and sha512crypt, mask a known pattern, fork across CPU cores, and read the pot file honestly.
ldapsearch
The ldapsearch quick reference: the flags, a modular copy-paste cheat sheet, and a worked breakdown of every real task. Find the base DN from the Root DSE, bind anonymously or with credentials, list users and groups, enumerate computers, hunt Kerberoastable accounts, page past a size limit, and query over LDAPS.
Metasploit
A practical Metasploit guide: install it, verify it, search modules, set options safely, validate findings with auxiliary checks, and keep a cheat sheet you will actually reuse.
msfvenom
A practical msfvenom guide: install it, verify it, pick a payload, set LHOST and LPORT, choose a format, generate controlled lab payloads, pair them with a handler, and keep a cheat sheet you will actually reuse.
tcpdump
The tcpdump quick reference: install and verify, the flags you actually use, a modular BPF cheat sheet, and one command per real situation. Isolate one host, watch a single service, catch DNS, filter by direction or protocol, read clear-text payload, save a clean PCAP for Wireshark, and rotate long captures unattended.
dnsenum
The dnsenum quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Pull records and name servers, test a zone transfer, brute force subdomains, pick a resolver for split-horizon DNS, sweep netranges, grow a wordlist, and export XML for your notes.
feroxbuster
The feroxbuster quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Run recursive content discovery, cap depth, filter soft-404 noise by size or words, add extensions, scan authenticated with a cookie, follow redirects, proxy through Burp, save JSON, and resume an interrupted scan.