PWNMI
Cheatsheets

Command reference

Growing, one command at a time. Each entry covers how it actually shows up in engagements, a link to an established reference, and the specific invocations worth remembering.

Recon & OSINT

Shodan Shodan search syntax for finding internet-facing devices and services by fingerprint, and PWNMI's top queries for real engagements. theHarvester theHarvester commands for OSINT recon — pulling emails, subdomains, and names from public sources, and PWNMI's top invocations for real engagements. Curl Curl commands for API testing and manual HTTP interaction — red team use and PWNMI's top invocations. Gobuster Gobuster commands for directory, DNS, and vhost enumeration — red team use and PWNMI's top invocations. Nmap Nmap commands for red team recon — host discovery, service detection, and PWNMI's top invocations for real engagements.

Web Application Testing

Burp Suite Burp Suite shortcuts, scope configuration, and lesser-used tabs beyond Proxy and Repeater, and PWNMI's top workflows for web application testing. Nikto Nikto commands for automated web server vulnerability scanning, and PWNMI's top invocations for red team use. Ffuf Ffuf commands for fast web fuzzing — directories, parameters, vhosts, and PWNMI's top invocations for red team use. Sqlmap Sqlmap commands for automated SQL injection detection and exploitation — red team use and PWNMI's top invocations.

Credential Attacks

BloodHound BloodHound and bloodhound-python commands for mapping Active Directory relationships and finding the shortest path to Domain Admins, and PWNMI's top invocations for red team use. NetExec NetExec (formerly CrackMapExec) commands for Active Directory enumeration and lateral movement, and PWNMI's top invocations for red team use. Hashcat Hashcat commands for GPU-accelerated password cracking — red team use and PWNMI's top invocations. Hydra Hydra commands for credential brute-forcing across services — red team use and PWNMI's top invocations. John the Ripper John the Ripper commands for offline password cracking — red team use and PWNMI's top invocations.

Exploitation & Post-Exploitation

Python3 The python3 one-liners and invocations that come up constantly on an engagement — reverse shells, TTY upgrades, quick file serving, and running PoC exploit scripts. GTFOBins How to use GTFOBins to turn a reachable Unix binary into a shell, a file read/write primitive, or privilege escalation — and PWNMI's most-cited example entries. LOLBAS How to use LOLBAS to find signed, pre-installed Windows binaries that can execute, download, or bypass controls — GTFOBins' Windows counterpart — and PWNMI's most-cited example entries. Impacket Suite The core Impacket scripts beyond secretsdump.py — Kerberoasting, AS-REP roasting, ticket handling, and remote execution against Windows and Active Directory targets. secretsdump.py Impacket's secretsdump.py commands for dumping credentials from Windows targets and domain controllers, and PWNMI's top invocations for red team use. Socat Socat commands for port forwarding, relays, and upgrading shells, and PWNMI's top invocations for red team use. Msfconsole (Metasploit) Msfconsole commands for the Metasploit Framework — red team use and PWNMI's top invocations for exploitation and post-exploitation. Netcat Netcat commands for listeners, reverse shells, and file transfer — red team use and PWNMI's top invocations.

Pivoting & Tunneling

Proxychains Proxychains commands for routing tools through a SOCKS proxy during pivoting, and PWNMI's top invocations for red team use. Chisel Chisel commands for TCP/UDP tunneling over HTTP — red team use and PWNMI's top invocations for pivoting. SSH (Tunneling & Pivoting) SSH commands for port forwarding, tunneling, and pivoting through a compromised host — red team use and PWNMI's top invocations.

Traffic & Analysis

Tcpdump Tcpdump commands and filter syntax for packet capture — red team use and PWNMI's top invocations. Tshark Tshark commands for command-line packet capture and analysis, and PWNMI's top invocations for red team and blue team use.

Hardware & Firmware

Binwalk Binwalk commands for identifying, extracting, and analyzing firmware images — signature scanning, recursive extraction, and entropy analysis.

Lab Infrastructure

Python Virtual Environments Isolating a PoC or tool's exact pip dependencies from system Python and from every other tool's dependencies, and PWNMI's top invocations for lab and engagement work. Git Git commands for cloning lab environments and PoC repos, tracking your own engagement notes and tooling, and a real recon technique against exposed .git directories. Docker Docker and Docker Compose commands for building and running isolated lab environments, and PWNMI's top invocations for lab work.