Execute Penetration Testing Commands

Provides a comprehensive command reference for penetration testing tools - network scanning, exploitation, password cracking, and web application testing - for quick lookup during authorized security assessments. Restricted to authorized security assessments, defensive validation, or controlled educational environments.

Use this skill when running network enumeration, exploiting a known vulnerability during an authorized engagement, cracking passwords with proper authorization, testing web application vulnerabilities, or auditing wireless network security. Not a fit for testing systems without written authorization - all scans risk detection, brute forcing can lock target accounts, and rate limiting affects tool behavior.

Requires a Kali Linux (or similar) distribution, authorized target IP addresses, wordlists for brute forcing, network access, and basic tool syntax familiarity. Produces network enumeration results, identified vulnerabilities, exploitation payloads, cracked credentials, and web vulnerability findings.

Covers Nmap commands for host discovery (ping sweep, list scan), port scanning (SYN/TCP connect/UDP, all-ports, specific ports), service/OS detection, and NSE scripts (vulnerability scanning, SMB enumeration, EternalBlue/MS08-067 checks, SSH brute force, HTTP enumeration, SQL injection checks). Covers Metasploit usage (launching msfconsole, searching and using exploits, setting RHOST/payload, running), named common exploits (EternalBlue, MS08-067/Conficker, vsftpd backdoor, Shellshock, Drupalgeddon2, PSExec), auxiliary scanners (port scan, SMB version/share enum, SSH/FTP brute force, RDP scanning), multi-handler setup for reverse shells, and msfvenom payload generation across Windows/Linux/PHP/ASP/WAR/Python targets.

Covers Nikto web scanning (basic/comprehensive scans, plugin-based scans for robots/shellshock/heartbleed/SSL, Metasploit-format export), SQLMap injection testing (database/table enumeration, table dumping, OS shell, POST/cookie injection, WAF tamper bypass, risk/level tuning), Hydra brute forcing across SSH/FTP/HTTP forms/SMB/RDP/MySQL, John the Ripper password cracking (wordlist attacks, format specification, SSH key and ZIP password cracking via ssh2john/zip2john), Aircrack-ng wireless auditing (monitor mode, packet capture, deauth attacks, WPA handshake cracking), and Wireshark/Tshark traffic capture and filtering by protocol or IP.

Provides quick-reference port scan variants and a password hash type table (MD5, SHA1, NTLM, sha512crypt, bcrypt, Kerberoast mode numbers). Includes worked examples (a one-line vulnerability scan, a combined Nikto-plus-SQLMap web app test) and a troubleshooting table covering slow scans, filtered ports, failed exploits, and uncrackable passwords.

Covers Nmap, Metasploit (msfconsole, msfvenom), Nikto, SQLMap, Hydra, John the Ripper, Aircrack-ng, and Wireshark/Tshark within a Kali Linux-style toolchain.

Authorized penetration testers and security researchers who need a fast command reference across the standard pentest toolchain rather than searching each tool's documentation separately during an assessment.

nmap -sV --script vuln 192.168.1.1