PWNMI

Guides

25 CLI Commands Every Hacker Needs to Get the Job Done

Updated July 23, 2026 · Written by PWNMI — see About.

This isn't 25 obscure tricks — it's the boring, load-bearing set of tools that actually show up, repeatedly, across a real engagement. Fluency here matters more than knowing one clever exploit, because you'll use most of these on every single target. Where a command has a full Cheatsheet entry, it's linked below.

Recon & Enumeration

  1. nmap — host discovery and service/version enumeration. First tool on almost every target, full stop.
  2. gobuster — directory, file, subdomain, and vhost brute-forcing. Finds what isn't linked anywhere.
  3. whois — domain registration lookup. Fast, low-noise way to get organizational context on a target before touching it.
  4. dig — DNS record queries (dig target.com ANY, dig target.com MX). Reveals mail servers, subdomains via records, and misconfigurations like open zone transfers.
  5. curl — manual HTTP interaction. For testing an endpoint directly, without a browser or proxy in the way.

Web Application Testing

  1. sqlmap — automated SQL injection detection and exploitation. Point it at a parameter, let it enumerate injection points and extract data.
  2. ffuf — fast web fuzzer for directories, parameters, and virtual hosts. Faster than gobuster for high-volume fuzzing, with more flexible filtering.
  3. nikto — web server vulnerability scanner. Noisy and dated in places, but still fast at flagging obvious misconfigurations and outdated software.

Credential Attacks

  1. hydra — online brute-force and password spraying across dozens of protocols.
  2. john (John the Ripper) — offline hash cracking with wordlist and rule-based attacks.
  3. hashcat — GPU-accelerated hash cracking. Where John is CPU-bound and flexible, hashcat is the tool for cracking at real scale.
  4. netexec (formerly CrackMapExec) — Active Directory and SMB credential validation, spraying, and enumeration across many hosts at once.

Exploitation & Post-Exploitation

  1. msfconsole (Metasploit) — the standard exploitation framework. Understand what a module is doing before running it, not just that it works.
  2. netcat — listeners, reverse shells, and quick file transfer. The tool behind most shells you'll ever catch.
  3. socat — like netcat but more flexible; handles encrypted relays and more complex redirection netcat can't.
  4. secretsdump.py (from Impacket) — dumps credentials and hashes from a domain controller or local SAM remotely, without needing a shell on the target first.

Pivoting & Tunneling

  1. ssh — local/remote/dynamic port forwarding through a compromised host with SSH access.
  2. chisel — TCP/UDP tunneling over HTTP, for pivoting when SSH isn't available on the foothold.
  3. proxychains — routes another tool's traffic through a SOCKS proxy (often one set up via SSH -D or chisel), so tools that don't natively support proxies can still reach a pivoted network.

Privilege Escalation

  1. linpeas.sh — automated Linux privilege escalation enumeration. Run it, then verify findings manually — see the script privesc checklist for the manual side of this.
  2. sudo -l — not a separate tool, but the single most important command to run once you have any shell: shows exactly what you can run as another user, and is often the whole privesc path by itself.

Traffic & Analysis

  1. tcpdump — packet capture at the command line, for confirming traffic is actually leaving or arriving.
  2. tshark — Wireshark's command-line counterpart, for filtering and analyzing captures without a GUI (useful on a headless pivot host).

General-Purpose Utilities

  1. grep — filtering command output and searching files. Shows up constantly across every other tool on this list — piping nmap or gobuster output through grep is routine.
  2. python3 — not a single command, but python3 -m http.server (quick file serving) and one-line reverse shells/scripts make it a permanent fixture in almost every session.

Next step

Most of these are covered in more depth as they come up throughout the site — start with Nmap fundamentals and Burp Suite fundamentals if you haven't already, and check the Cheatsheets section as it grows for deeper reference on the rest.