Windows Download Methods
The Windows-native ways to pull a file when you have a shell on a Windows host: certutil, bitsadmin, PowerShell Invoke-WebRequest, WebClient, and the in-memory IEX cradle, with an honest look at how defenders see each one.
Guides
Start-here how-tos for newcomers to hands-on security.
Difficulty
Tags
No matches.
All entries
SMB File Transfer
Move files to and from a Windows target over SMB: stand up a share with impacket-smbserver, then pull, run, and push back with native copy / net use or smbclient. Quick reference with a modular cheat sheet and per-command breakdowns.
SCP and SSH File Transfer
The scp and sftp quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real transfer. Upload and download, copy a directory with -r, authenticate with a recovered key, hop through a jump host, pipe over ssh when scp is missing, and verify with a checksum.
Netcat File Transfer
The netcat file-transfer quick reference: flags, a modular cheat sheet, and worked breakdowns. Listen and save, connect and send, close cleanly with -N or -q0, stream a directory with tar, encrypt with socat OPENSSL, fall back to bash /dev/tcp when nc is missing, and checksum to catch truncation.
HTTP File Transfer
The HTTP file-transfer quick reference: serve a folder from your attacker box in one line, then pull files onto the target with wget, curl, certutil, PowerShell, or curl.exe. Flags, a modular cheat sheet, in-memory execution, upload-back with updog, checksum verification, and beating egress filters by serving on 80 or 443.
Getting Files onto a Target
The file-transfer quick reference: the serve-and-pull vs push-and-receive decision, a modular copy-paste cheat sheet, and a worked breakdown of every method. Serve a folder over HTTP, pull with wget or certutil, host an SMB share, move a file with netcat or socat, copy over scp, paste a base64 blob, and checksum both ends.
base64 File Transfer
The base64 file-transfer quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Encode a file to one pasteable line, decode it with a heredoc, move files with certutil or PowerShell on Windows, chunk a blob too long to paste, and checksum both ends to prove it arrived intact.
NetExec
A practical NetExec guide: install it, verify it, enumerate one protocol at a time, validate credentials without locking accounts, read the output honestly, and keep a cheat sheet you will actually reuse.
socat
The socat quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Verbose TCP client, port forward, UNIX-socket-to-TCP bridge, TLS wrap, hex-dump a protocol, upgrade a reverse shell to a full PTY, and a virtual serial pair.
whois
The whois quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Look up a domain, find who owns an IP, enumerate a netblock, pull name servers, read registration dates, query a registry directly, and route around a redacted or wrong-server answer with RDAP.
wget
The wget quick reference: install and verify, a modular copy-paste cheat sheet, and one command for every real situation. Resume a broken download, mirror a site for offline viewing, pull a list of URLs, reuse a login cookie, POST a form, and rate-limit to stay quiet.
TShark
The TShark quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Read a PCAP, filter by BPF or display syntax, extract clean fields, follow a TCP stream, pull cleartext creds, carve files out of HTTP, and spot a port scan.
enum4linux-ng
The enum4linux-ng quick reference: the flags that matter, a modular copy-paste cheat sheet, and a worked breakdown of every real SMB and RPC situation. List shares anonymously, enumerate users and groups, dump the password policy, RID-cycle when direct enum is blocked, add credentials for depth, and export clean JSON or YAML.
sqlmap
The sqlmap quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Confirm an injectable parameter, feed a saved Burp request, fingerprint the DBMS, walk the dbs/tables/columns ladder, dump only the columns you need, grab password hashes, evade a WAF with tamper scripts, and route through a proxy.
Nikto
The Nikto quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real scan. Scan HTTP and HTTPS, hit odd ports, reach a vhost by Host header, tune out the noise, proxy through Burp, save a machine-readable report, and pull just the findings.
dirsearch
The dirsearch quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real content-discovery task. Pick a wordlist, append extensions, filter soft-404s by size, recurse into found directories, scan a list of hosts, save JSON, and proxy through Burp.
dig
The dig quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Resolve A/AAAA, find MX and NS, read SPF and DMARC TXT, reverse-lookup an IP, query a specific resolver, trace delegation from the root, and test a zone transfer.
John the Ripper
The John the Ripper quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Identify a hash, convert a ZIP or SSH key with a *2john script, run wordlist and rule attacks, crack NT and sha512crypt, mask a known pattern, fork across CPU cores, and read the pot file honestly.
ldapsearch
The ldapsearch quick reference: the flags, a modular copy-paste cheat sheet, and a worked breakdown of every real task. Find the base DN from the Root DSE, bind anonymously or with credentials, list users and groups, enumerate computers, hunt Kerberoastable accounts, page past a size limit, and query over LDAPS.
Metasploit
A practical Metasploit guide: install it, verify it, search modules, set options safely, validate findings with auxiliary checks, and keep a cheat sheet you will actually reuse.
msfvenom
A practical msfvenom guide: install it, verify it, pick a payload, set LHOST and LPORT, choose a format, generate controlled lab payloads, pair them with a handler, and keep a cheat sheet you will actually reuse.
tcpdump
The tcpdump quick reference: install and verify, the flags you actually use, a modular BPF cheat sheet, and one command per real situation. Isolate one host, watch a single service, catch DNS, filter by direction or protocol, read clear-text payload, save a clean PCAP for Wireshark, and rotate long captures unattended.
dnsenum
The dnsenum quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Pull records and name servers, test a zone transfer, brute force subdomains, pick a resolver for split-horizon DNS, sweep netranges, grow a wordlist, and export XML for your notes.
feroxbuster
The feroxbuster quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Run recursive content discovery, cap depth, filter soft-404 noise by size or words, add extensions, scan authenticated with a cookie, follow redirects, proxy through Burp, save JSON, and resume an interrupted scan.
radare2
The radare2 quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Load and analyze a binary, list functions, strings, and imports, disassemble main, read control flow in graph mode, patch a jump, debug under breakpoints, diff two builds, and script it with r2pipe.
pwntools
A practical pwntools guide: install it, wire up process and remote I/O, pack and unpack values, build ROP helpers, read the output honestly, and keep a cheat sheet you will actually reuse.
PowerView
A practical PowerView guide for authorized AD labs: load the module, enumerate users, groups, ACLs, and trusts from a domain-joined host, read the output, and understand the defenses that watch it.
GDB
The GDB quick reference with GEF and pwndbg: launch flags, a modular cheat sheet, and a worked breakdown of every real situation. Break on a stripped binary, step by instruction, read args in registers, dump the stack, watch a variable, measure an overflow offset with cyclic, inspect the heap, and debug a core dump post-mortem.
WinPEAS
A practical WinPEAS guide: get the Windows privilege-escalation enumerator onto a target, read its color-coded output, focus on the high-signal findings, and avoid drowning in noise.
Wfuzz
The Wfuzz quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Fuzz paths, query and POST parameters, headers, cookies, and virtual hosts, filter custom-404 noise by size, brute a login with two markers, encode payloads on the fly, and proxy through Burp.
Stegseek
The Stegseek quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Brute-force a Steghide passphrase against rockyou, extract the hidden payload, confirm a carrier with seed mode, batch many files, and identify what you recovered before opening it.
Smbmap
The smbmap quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. List shares over a null session, read the READ/WRITE flags honestly, recurse a share, pull and push files, pass the hash, and run an authorized remote command.
RustScan
The RustScan quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Sweep all 65535 TCP ports in seconds, hand the open ones to Nmap for versions and scripts, scan a subnet or a file of hosts, fix too many open files, tune speed on a laggy link, and pull a greppable port list.
Pspy
The pspy quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Transfer the static binary, watch processes and cron fire in real time without root, catch a UID=0 root timer, save and grep the feed for root commands, and turn a writable cron script into a privilege-escalation lead.
PowerUp
A practical PowerUp guide: run the PowerSploit Windows privesc auditor, read its check output honestly, focus on the high-signal service and path findings, and keep it lab-safe.
LinPEAS
The LinPEAS quick reference: the flags that matter, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Deliver the script to a target, run and save a clean no-color report, tune the depth (stealth, all-checks, extra, regex), scope checks by group or MITRE technique, grep the high-signal findings, and read the color legend honestly.
LinEnum
The LinEnum quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Deliver the script to a foothold, run default vs thorough, hunt keywords, export files, write a report, and read the sudo, SUID/SGID, cron, and creds sections that matter.
Hash-Identifier
The hash-identifier quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Turn an unknown hash into the right hashcat -m mode or john --format, triage a mixed dump, read prefixes like $6$ and $2y$, break the MD5-vs-NTLM tie, and hand the type straight to a cracker.
Exiftool
The exiftool quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Dump every tag, pull GPS as decimal, surface hidden CTF fields, extract the embedded thumbnail, strip metadata before publishing, shift wrong timestamps, and batch a folder to CSV.
Chisel
A practical Chisel guide: tunnel TCP and UDP over HTTP, build a reverse SOCKS pivot from a foothold, reach internal hosts, and keep the noise low in a lab.
CeWL
The CeWL quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Crawl an authorized site, build a wordlist from its own words, tune depth and length, harvest emails and document authors, rank by frequency, then feed hydra, john, and hashcat.
BloodHound
A practical BloodHound guide: collect Active Directory graph data, ingest it, hunt attack paths to Domain Admin, and read the output without chasing dead ends.
Binwalk
The Binwalk quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Map firmware with a signature scan, extract nested layers recursively, carve a byte range with dd, read entropy for compression vs encryption, filter to just the filesystem, and identify a raw blob's CPU architecture.
Steghide
The Steghide quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Inspect a carrier for a payload, try the empty passphrase, extract with a known one, crack an unknown passphrase with stegseek, embed your own data, and pick the right tool when the format is not JPEG or WAV.
SearchSploit
The SearchSploit quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Search by product and version, match a CVE, pin a strict version, filter DoS noise, read code in the pager, mirror an exploit, output JSON, and triage straight from an Nmap scan.
Mimikatz
A practical Mimikatz guide for authorized AD labs: what it extracts, the core modules, how to read the output, and the defenses that stop it.
Evil-WinRM
A practical Evil-WinRM guide: get an interactive WinRM shell on Windows with a password, hash, or certificate, move files, load scripts, and stay inside scope.
Nmap
The Nmap quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Ping-sweep a subnet, scan all 65535 ports, fingerprint service versions, run safe NSE scripts, scan UDP, get past a blocked ping, and save output for your notes.
Hashcat
The Hashcat quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Pick the exact hash mode, run dictionary, rule, mask, and hybrid attacks, crack NTLM, sha512crypt, WPA, and Kerberoast hashes, read the status screen, and resume long jobs.
DNSRecon
The DNSRecon quick reference: modes, flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Pull standard records, test a zone transfer, brute force subdomains, reverse an IP range, walk a DNSSEC zone, pin a resolver, and save CSV/JSON you can diff.
rpcclient
The rpcclient quick reference: connection flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Open a null session, enumerate users, groups, RIDs, and shares, read the password policy, map names to SIDs, RID-cycle, authenticate with an NT hash, and read NT_STATUS errors honestly.
curl
The curl quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. POST JSON, follow redirects, reuse cookies, pin DNS, resume a download, ignore a self-signed cert, time a slow endpoint, and proxy through Burp.
Gobuster
The Gobuster quick reference: modes, flags, a modular cheat sheet, and a worked breakdown of every real task. Brute-force directories and files, discover vhosts and DNS subdomains, filter false positives by status and length, fuzz with the FUZZ keyword, route through Burp, and enumerate open S3 buckets.
Impacket
A practical Impacket guide: install it, verify it, pick the right script, handle credential and hash syntax cleanly, read protocol errors honestly, and keep a cheat sheet you will actually reuse.
WPScan
The WPScan quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Enumerate users, find vulnerable plugins and themes, pull exposed config backups, run an authorized login attack, tune detection-mode noise, and parse the JSON with jq.
smbclient
The smbclient quick reference: flags, a modular cheat sheet, and a worked breakdown of every real situation. List shares over a null session, browse a share interactively, pull one file or a whole tree, pass-the-hash, force an SMB dialect, grab a share as a tar, and debug a refused connection.
WhatWeb
The WhatWeb quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Fingerprint a target, tune aggression, chase redirects to the real app, hit a vhost by Host header, scan a list, proxy through Burp, and save structured JSON.
ffuf
The ffuf quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Fuzz directories and extensions, discover hidden parameters and virtual hosts, fuzz JSON and login bodies, calibrate away catch-all pages, filter by size, words, or regex, recurse, and replay a captured request.
Responder
A practical Responder guide: install it, pick the right interface, start in analyze mode, capture lab name-resolution traffic safely, read the output honestly, and keep a cheat sheet you will actually reuse.
SecLists
The SecLists quick reference: the folders that matter, the file tools and flags you pair with a list, and a modular cheat sheet. Pick a web-content list, brute subdomains, fuzz a vhost, feed ffuf and gobuster, run a gentle Hydra login test, crack hashes offline, and carve a big list into a focused slice.
Netcat
The netcat quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Check a port, grab a banner, hand-speak HTTP or SMTP, scan a small range, move a file or a whole directory between lab hosts, dial through a SOCKS proxy, and catch a reverse shell.
Amass
The Amass quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real recon situation. Enumerate subdomains passively then actively, load API keys for real coverage, brute force names, pull JSON with jq, find related domains by WHOIS/ASN/CIDR, diff the stored database, and validate before you scan.
testssl.sh
The testssl.sh quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Confirm old protocols are off, read the certificate chain, run every named-vuln check, list ciphers, scan STARTTLS mail ports, and pin one backend behind a load balancer.
Hydra
The Hydra quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Test SSH/FTP/SMB/RDP and database logins, brute an HTTP form with a fail or success marker, spray one password lockout-safe, tune tasks and rate, save hits, and resume an aborted run, all inside scope.
theHarvester
The theHarvester quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Pull subdomains from certificate transparency, scrape hosts and emails from search engines, resolve and validate leads with DNS, page a noisy source, wire in API keys, save JSON for jq, and run it in Docker.
DIRB
The DIRB quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real scan. Run a first pass, append extensions, scope one directory, scan behind basic auth, reuse a session cookie, proxy through Burp, and survive a wildcard server.
sslscan
The sslscan quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Scan a non-standard TLS port, upgrade a STARTTLS mail service, set SNI on a shared host, check for Heartbleed, read the cipher and certificate output, and diff a hardening change over time.