Command Reference
Command Reference
Komut Referansı
NMAP - Network Scanning
$ nmap -sS -p- 192.168.1.1
TCP SYN Scan auf alle Ports (Stealth Scan)
$ nmap -sV -sC -O 192.168.1.1
Service/Version Detection + Standard Scripts + OS Detection
$ nmap -A -T4 192.168.1.0/24
Aggressiver Scan des gesamten Subnets (schneller)
$ nmap --script vuln 192.168.1.1
Vulnerability Scan mit NSE Scripts
$ nmap -p 80,443 --script http-enum 192.168.1.1
Web Server Enumeration (Directories, Files)
GREP - Pattern Matching
$ grep -r "password" /var/www/
Rekursive Suche nach "password" in Verzeichnis
$ grep -i "error" /var/log/*.log
Case-insensitive Suche in allen Log-Dateien
$ grep -E "^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$" file.txt
IP-Adressen mit Regex extrahieren
$ grep -v "^#" config.conf | grep -v "^$"
Kommentare und leere Zeilen entfernen
NETCAT - Swiss Army Knife
$ nc -lvnp 4444
Listener starten (Reverse Shell)
$ nc -zv 192.168.1.1 1-1000
Port Scan (Ports 1-1000)
$ nc 192.168.1.1 80 < request.txt
HTTP Request manuell senden
HYDRA - Password Cracking
$ hydra -l admin -P wordlist.txt ssh://192.168.1.1
SSH Brute Force mit Wordlist
$ hydra -L users.txt -P pass.txt ftp://192.168.1.1
FTP Brute Force mit User + Password Liste
SYSTEM RECON
$ find / -perm -4000 2>/dev/null
SUID Binaries finden (Privilege Escalation)
$ ss -tulpn | grep LISTEN
Alle Listening Ports + Prozesse anzeigen
$ cat /etc/passwd | grep -E "sh$"
Alle Benutzer mit Shell-Zugriff
$ ps aux | grep root
Alle Prozesse die als root laufen
WEB EXPLOITATION
$ curl -X POST -d "user=admin&pass=1234" http://target.com/login
POST Request mit Parametern
$ curl -H "User-Agent: Mozilla/5.0" http://target.com
Custom Header setzen
$ sqlmap -u "http://target.com?id=1" --dbs
SQL Injection - Datenbanken enumerieren
NMAP - Network Scanning
$ nmap -sS -p- 192.168.1.1
TCP SYN Scan on all ports (Stealth Scan)
$ nmap -sV -sC -O 192.168.1.1
Service/Version Detection + Default Scripts + OS Detection
$ nmap -A -T4 192.168.1.0/24
Aggressive scan of entire subnet (faster)
$ nmap --script vuln 192.168.1.1
Vulnerability scan with NSE scripts
$ nmap -p 80,443 --script http-enum 192.168.1.1
Web server enumeration (Directories, Files)
GREP - Pattern Matching
$ grep -r "password" /var/www/
Recursive search for "password" in directory
$ grep -i "error" /var/log/*.log
Case-insensitive search in all log files
$ grep -E "^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$" file.txt
Extract IP addresses with regex
$ grep -v "^#" config.conf | grep -v "^$"
Remove comments and empty lines
NETCAT - Swiss Army Knife
$ nc -lvnp 4444
Start listener (Reverse Shell)
$ nc -zv 192.168.1.1 1-1000
Port scan (Ports 1-1000)
$ nc 192.168.1.1 80 < request.txt
Send HTTP request manually
HYDRA - Password Cracking
$ hydra -l admin -P wordlist.txt ssh://192.168.1.1
SSH Brute Force with wordlist
$ hydra -L users.txt -P pass.txt ftp://192.168.1.1
FTP Brute Force with user + password list
SYSTEM RECON
$ find / -perm -4000 2>/dev/null
Find SUID binaries (Privilege Escalation)
$ ss -tulpn | grep LISTEN
Show all listening ports + processes
$ cat /etc/passwd | grep -E "sh$"
All users with shell access
$ ps aux | grep root
All processes running as root
WEB EXPLOITATION
$ curl -X POST -d "user=admin&pass=1234" http://target.com/login
POST request with parameters
$ curl -H "User-Agent: Mozilla/5.0" http://target.com
Set custom header
$ sqlmap -u "http://target.com?id=1" --dbs
SQL Injection - enumerate databases
NMAP - Ağ Tarama
$ nmap -sS -p- 192.168.1.1
Tüm portlarda TCP SYN Tarama (Gizli Tarama)
$ nmap -sV -sC -O 192.168.1.1
Servis/Versiyon Tespiti + Varsayılan Scriptler + OS Tespiti
$ nmap -A -T4 192.168.1.0/24
Tüm subnet'in agresif taraması (daha hızlı)
$ nmap --script vuln 192.168.1.1
NSE scriptleri ile zafiyet taraması
$ nmap -p 80,443 --script http-enum 192.168.1.1
Web sunucu enumerasyonu (Dizinler, Dosyalar)
GREP - Pattern Eşleştirme
$ grep -r "password" /var/www/
Dizinde "password" için recursive arama
$ grep -i "error" /var/log/*.log
Tüm log dosyalarında büyük/küçük harf duyarsız arama
$ grep -E "^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$" file.txt
Regex ile IP adreslerini çıkart
$ grep -v "^#" config.conf | grep -v "^$"
Yorumları ve boş satırları kaldır
NETCAT - İsviçre Çakısı
$ nc -lvnp 4444
Listener başlat (Reverse Shell)
$ nc -zv 192.168.1.1 1-1000
Port taraması (1-1000 portları)
$ nc 192.168.1.1 80 < request.txt
HTTP isteği manuel olarak gönder
HYDRA - Şifre Kırma
$ hydra -l admin -P wordlist.txt ssh://192.168.1.1
Wordlist ile SSH Brute Force
$ hydra -L users.txt -P pass.txt ftp://192.168.1.1
Kullanıcı + şifre listesi ile FTP Brute Force
SİSTEM KEŞFİ
$ find / -perm -4000 2>/dev/null
SUID binary'lerini bul (Yetki Yükseltme)
$ ss -tulpn | grep LISTEN
Tüm dinleyen portları + işlemleri göster
$ cat /etc/passwd | grep -E "sh$"
Shell erişimi olan tüm kullanıcılar
$ ps aux | grep root
Root olarak çalışan tüm işlemler
WEB EXPLOITATION
$ curl -X POST -d "user=admin&pass=1234" http://target.com/login
Parametreli POST isteği
$ curl -H "User-Agent: Mozilla/5.0" http://target.com
Özel header ayarla
$ sqlmap -u "http://target.com?id=1" --dbs
SQL Injection - veritabanlarını listele
