eJPT cheat sheet

Nmap -sS (SYN/half-open scan) requires root and never completes the TCP handshake; -sT uses connect() and works without raw-socket privileges.

Nmap port states are open, closed, filtered, unfiltered, and open|filtered; -sU scans UDP and is slow because open|filtered is the common result.

-sn performs a ping-sweep discovery with no port scan, while -Pn skips discovery entirely and treats every target as online.

Metasploit workflow is search, use, show options, set RHOSTS/LHOST/LPORT, run; sessions -l lists sessions and sessions -i interacts with one.

Meterpreter post-exploitation commands: getuid, getsystem, hashdump, migrate , background; migration moves the session into a stable process.

SMB enumeration commands: enum4linux -a , smbclient -L // -N, and crackmapexec smb -u -p --shares.

Pass-the-hash uses Impacket psexec.py or wmiexec.py with -hashes LM:NT, authenticating with the NTLM hash instead of a plaintext password.

Pivoting uses meterpreter autoroute or route through an existing session plus portfwd add -l -r -p , then a SOCKS proxy to reach internal hosts.

Linux privilege-escalation checks: sudo -l, find / -perm -4000 -type f 2>/dev/null for SUID binaries, uname -a for kernel version, and writable cron entries.

PTES phases in order: pre-engagement interactions, intelligence gathering, threat modeling, vulnerability analysis, exploitation, post-exploitation, and reporting.

Passive reconnaissance generates no direct traffic to the target (whois, Shodan, theHarvester, cached search results); active reconnaissance does (Nmap, dig, banner grabs).

DNS testing: dig axfr @ns.target.com target.com attempts a zone transfer, and dig +short or host -t MX reveals address and mail records.

CVSS v3 base score bands: 0.1-3.9 low, 4.0-6.9 medium, 7.0-8.9 high, 9.0-10.0 critical.

Rules of engagement record scope (in-scope and out-of-scope IPs and domains), permitted techniques, test window, emergency contacts, and signed authorization.

Scanning and enumeration differ: scanning identifies open ports and live services; enumeration extracts users, shares, versions, and service-specific data.

MITRE ATT&CK organizes adversary behavior as tactics (the why) containing techniques (the how), e.g., TA0001 Initial Access contains T1566 Phishing.

A penetration test report contains an executive summary, scope and methodology, findings with evidence and risk ratings, remediation guidance, and appendices.

Credentialed vulnerability scans authenticate over SSH or SMB and detect missing patches and local misconfigurations that unauthenticated scans cannot see.

Lynis (lynis audit system) audits Linux hosts and reports a hardening index plus warnings for permissions, running services, and kernel settings.

Linux listening-service audit: ss -tulpn or netstat -tulpn lists sockets and owning processes; lsof -i : identifies a single listener.

Key file permissions: /etc/shadow should be 640 root:shadow or stricter; world-readable shadow files or SSH private keys are audit findings.

Windows logon audit event IDs: 4624 successful logon, 4625 failed logon, 4672 special privileges assigned, 4720 user account created.

Windows audit policy is read with auditpol /get /category:* and configured through secpol.msc, gpedit.msc, or Group Policy Objects.

Password policy baselines live in /etc/login.defs (PASS_MAX_DAYS, PASS_MIN_LENGTH) and pam_pwquality on Linux, and in net accounts on Windows.

File integrity monitoring with AIDE or Tripwire compares stored hashes against current file state and flags unauthorized modification.

OWASP Top 10 2021 order begins: A01 Broken Access Control, A02 Cryptographic Failures, A03 Injection, A04 Insecure Design, A05 Security Misconfiguration.

SQL injection probes include a single quote, ' OR 1=1-- , and ' UNION SELECT NULL-- ; sqlmap -u --batch --dbs automates detection and database enumeration.

XSS variants: reflected appears in the immediate response, stored is persisted server-side, and DOM-based occurs in client-side JavaScript sinks.

Local file inclusion payload ../../../../etc/passwd confirms traversal; php://filter/convert.base64-encode/resource=index.php discloses PHP source.

Command injection separators are ; | || && and substitution with backticks or $(); a time delay such as ; sleep 10 confirms blind execution.

Content discovery: gobuster dir -u -w -x php,txt or ffuf -w -u /FUZZ enumerates hidden paths.

Cookie attributes: Secure restricts the cookie to HTTPS, HttpOnly blocks JavaScript access, and SameSite=Strict or Lax limits cross-site sending.

Burp Suite components: Proxy intercepts and edits traffic, Repeater resends one request, Intruder automates payload fuzzing, Decoder handles encoding.