Search everything Ctrl K

Tools

Each tool with its cheat sheet, the commands we already have in other cheatsheets, the guides that use it and the Hack The Box machines where it appears, with the exact minute of the IppSec video.

Reconnaissance

Linux · Windows · macOS (Rust) feroxbuster Fast, recursive web content discovery. feroxbuster cheat sheet and HTB machines where it is used. 5 commands · 1 machine Open → Linux · Windows · macOS (Go) ffuf Very fast web fuzzer for directories, vhosts, parameters and values. ffuf cheat sheet with filters and HTB machines where it is used. 10 commands · 17 machines Open → Linux · Windows · macOS (Go) Gobuster Brute forcing of directories, files, vhosts and DNS subdomains. Gobuster cheat sheet and HTB machines where it is used. 7 commands · 40 machines Open → Linux · Windows · macOS Nmap Port and service scanner: the first command on any box. Commands, NSE scripts and HTB machines where it is used. 15 commands · 9 machines Open →

Web

Linux · Windows · macOS (Python) git-dumper Downloads a .git repository exposed on a website so you can read the code and its history. Cheat sheet and HTB machines. 5 commands · 7 machines Open → Linux · Windows · macOS (Python) jwt_tool Swiss army knife for attacking JSON Web Tokens: alg none, key confusion, kid and secret cracking. Cheat sheet and HTB machines. 7 commands Open → Linux · Windows · macOS (Go) Nuclei Template-based vulnerability scanner: CVEs, exposed panels and misconfigurations. Cheat sheet and HTB machines. 4 commands · 2 machines Open → Linux · Windows · macOS (Python) sqlmap Automatic detection and exploitation of SQL injection. sqlmap cheat sheet, guides and HTB machines where it is used. 11 commands · 4 machines Open → Linux · macOS (Ruby) WPScan WordPress scanner: version, plugins, themes, users and password brute force. WPScan cheat sheet and HTB machines. 4 commands · 3 machines Open → Java (ysoserial) · .NET (ysoserial.net) ysoserial Generates insecure deserialization payloads for Java and .NET (ysoserial.net), including ViewState. Cheat sheet and HTB machines. 4 commands · 8 machines Open →

Privilege escalation

Linux (sh) linPEAS Script that checks every Linux privilege escalation path: sudo, SUID, capabilities, cron, credentials and kernel. Cheat sheet and HTB machines. 8 commands · 5 machines Open → Linux (Go) pspy Shows in real time the processes started on Linux, including root cron jobs, without being root. pspy cheat sheet and HTB machines. 4 commands · 13 machines Open → Windows (.exe, .bat, .ps1) winPEAS Checks Windows services, privileges, saved credentials, AlwaysInstallElevated and more escalation paths. Cheat sheet and HTB machines. 5 commands · 6 machines Open →

Pivoting and tunnels

Linux · Windows · macOS (Go) Chisel TCP tunnels and SOCKS proxy over HTTP to reach internal ports and networks. Chisel cheat sheet and HTB machines where it is used. 6 commands · 21 machines Open → Linux · Windows · macOS (Go) Ligolo-ng Pivoting through a TUN interface: reach the internal network as if you were inside, without proxychains. Ligolo-ng cheat sheet and HTB machines. 8 commands Open →

Passwords

Linux · Windows · macOS (GPU) Hashcat GPU hash cracking: the modes most used in CTFs (NTLM, NetNTLMv2, Kerberos, bcrypt), rules and masks. Cheat sheet and HTB machines. 15 commands · 24 machines Open → Linux Hydra Online brute forcing against SSH, FTP, SMB, web forms and dozens of protocols. Hydra cheat sheet and HTB machines. 6 commands · 4 machines Open → Linux · Windows · macOS John the Ripper Password cracking with formats for almost everything: zip, SSH, KeePass, PDF, Office and GPG via the *2john tools. Cheat sheet and HTB machines. 8 commands · 11 machines Open →

Exploitation and C2

Linux · Windows · macOS (Ruby) Metasploit Exploitation framework with msfconsole, msfvenom and Meterpreter: payloads, exploits and post-exploitation. Metasploit cheat sheet and HTB machines. 13 commands · 17 machines Open → Linux · Windows · macOS (Go) Sliver Open source command and control (C2) framework: implants over mTLS, HTTPS, DNS and WireGuard. Sliver cheat sheet. 9 commands Open →

Reversing and pwn

Linux · Windows · macOS (Java) Ghidra The NSA's free disassembler and decompiler for understanding binaries. First steps, triage commands and HTB machines where it is used. 4 commands · 9 machines Open → Linux (Python) pwntools Python library for writing binary exploits: cyclic patterns, ELF, ROP and local or remote connections. pwntools cheat sheet. 4 commands Open →

Forensics

Linux · Windows · macOS Wireshark y tshark Traffic capture and analysis: filters, cleartext credentials and exporting files from a pcap with tshark. Cheat sheet and HTB machines. 7 commands · 6 machines Open →

See the MITRE ATT&CK matrix → · Cheatsheets and generators →