> For the complete documentation index, see [llms.txt](https://blog.rootkid.in/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://blog.rootkid.in/exam-prep-notes/certified-ethical-hacker-v12-practical-notes/extra-resources/cheat-sheet.md).

# Cheat Sheet

## Namp (Network Mapper) - Cheat Sheet

{% embed url="<https://files.gitbook.com/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FA119ZKHns4DDR7RiN4UG%2Fuploads%2Fu4JuE6ONc32pgQFLxCEp%2FNmap-Cheat-Sheet.pdf?alt=media&token=f9a46596-cb26-46f3-b1cd-d7b2e24c6d0d>" %}

## Dirsearch - Cheat Sheet

> Web path scanner. More information: <https://github.com/maurosoria/dirsearch>.

* Scan a web server for common paths with common extensions:

```bash
dirsearch --url {{url}} --extensions-list
```

* Scan a list of web servers for common paths with the .php extension:

```bash
dirsearch --url-list {{path/to/url-list.txt}} --extensions {{php}}
```

* Scan a web server for user-defined paths with common extensions:

{% code overflow="wrap" %}

```bash
dirsearch --url {{url}} --extensions-list --wordlist {{path/to/url-paths.txt}}
```

{% endcode %}

* Scan a web server using a cookie:

{% code overflow="wrap" %}

```bash
dirsearch --url {{url}} --extensions {{php}} --cookie {{cookie}}
```

{% endcode %}

* Scan a web server using the HEAD HTTP method:

```bash
dirsearch --url {{url}} --extensions {{php}} --http-method {{HEAD}}
```

* Scan a web server, saving the results to a .json file:

{% code overflow="wrap" %}

```bash
dirsearch --url {{url}} --extensions {{php}} --json-report {{path/to/report.json}}
```

{% endcode %}

Reference: <https://github.com/inetum-peru/cheatsheet/blob/develop/dirsearch>

## Metasploit - Cheat Sheet <a href="#pagetitle" id="pagetitle"></a>

## Enum4Linux - Cheat Sheet

| COMMAND                                                                                  | DESCRIPTION                                                                                                           |
| ---------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------- |
| `enum4linux -v target-ip`                                                                | Verbose mode, shows the underlying commands being executed by enum4linux                                              |
| `enum4linux -a target-ip`                                                                | Do Everything, runs all options apart from dictionary based share name guessing                                       |
| `enum4linux -U target-ip`                                                                | Lists usernames, if the server allows it - (RestrictAnonymous = 0)                                                    |
| <p><code>enum4linux -u administrator</code><br><code>-p password -U target-ip</code></p> | If you've managed to obtain credentials, you can pull a full list of users regardless of the RestrictAnonymous option |
| `enum4linux -r target-ip`                                                                | Pulls usernames from the default RID range (500-550,1000-1050)                                                        |
| `enum4linux -R 600-660 target-ip`                                                        | Pull usernames using a custom RID range                                                                               |
| `enum4linux -G target-ip`                                                                | Lists groups. if the server allows it, you can also specify username `-u` and password `-p`                           |
| `enum4linux -S target-ip`                                                                | List Windows shares, again you can also specify username `-u` and password `-p`                                       |
| `enum4linux -s shares.txt target-ip`                                                     | Perform a dictionary attack, if the server doesn't let you retrieve a share list                                      |
| `enum4linux -o target-ip`                                                                | Pulls OS information using smbclient, this can pull the service pack version on some versions of Windows              |
| `enum4linux -i target-ip`                                                                | Pull information about printers known to the remove device.                                                           |

## John the Ripper - Cheat Sheet

{% embed url="<https://github.com/lyudaio/cheatsheets/blob/main/security/tools/johntheripper.md>" %}

***

***

***

**`Hacker's Mantra:`**`Playfully doing something difficult, whether useful or not, that is hacking. - Richard Stallman`