(01)// Recon
INTERMEDIATElinuxmacos
Nmap — Full TCP port scan with version detection
Scans all 65535 TCP ports with service version detection and default scripts. -oA saves output in all three formats.
nmaptcpversion-detectionscripts
(02)// Recon
INTERMEDIATElinuxmacos
Scans the 20 most common UDP ports. UDP is slow — be patient.
nmapudp
(03)// Recon
ADVANCEDlinux
Nmap — Stealth SYN scan with OS detection
SYN scan (half-open, less noisy) with OS fingerprinting. Requires root.
nmapsyn-scanos-detectionstealth
(04)// Recon
BEGINNERlinux
Gobuster — Directory bruteforce
Brute-forces directories and files. -x adds extension fuzzing.
gobusterwebdirectory-bruteforcefuzzing
(05)// Recon
INTERMEDIATElinuxmacos
Ffuf — Virtual host fuzzing
Discovers virtual hosts by fuzzing the Host header. Filter by word count to remove false positives.
ffufvhostsubdomainfuzzing
(06)// Recon
BEGINNERlinux
Whatweb — Web technology fingerprinting
Identifies CMS, frameworks, server software, headers. -a 3 is aggressive mode.
whatwebfingerprintingwebcms
(07)// Enumeration
BEGINNERlinux
SMB — Enumerate shares with null session
Lists SMB shares without authentication (null session).
smbsmbclientsharesnull-session
(08)// Enumeration
INTERMEDIATElinux
SMB — Enumerate with enum4linux-ng
Full SMB/LDAP enumeration: users, groups, shares, password policy, OS info.
enum4linuxsmbusersgroupsldap
(09)// Enumeration
BEGINNERlinux
SNMP — Walk community string
Walks the full SNMP MIB tree using the default community string "public".
snmpsnmpwalkcommunity-string
(10)// Enumeration
INTERMEDIATElinux
Ldapsearch — Anonymous LDAP query
Queries LDAP anonymously for all objects. Replace dc values with target domain.
ldapldapsearchactive-directoryanonymous
(11)// Enumeration
BEGINNERlinuxmacos
Simple banner grab. Connect to a port and read whatever the service sends.
netcatncbannergrabbing
(12)// PrivEsc
BEGINNERlinux
LinPEAS — Linux privilege escalation script
Automated Linux privilege escalation enumeration. Checks SUID, cron, writable paths, sudo, capabilities.
linpeaslinuxprivescautomated
(13)// PrivEsc
BEGINNERlinuxmacos
Sudo — Check allowed commands
Lists commands the current user can run with sudo. Check GTFOBins for each result.
sudolinuxprivescgtfobins
(14)// PrivEsc
BEGINNERlinux
SUID — Find SUID binaries
Finds all SUID binaries on the system. Cross-reference each with GTFOBins.
suidlinuxprivescfindgtfobins
(15)// PrivEsc
INTERMEDIATElinux
Cron — Find writable cron paths
Checks system cron jobs and finds writable shell scripts that may be executed by root cron.
cronlinuxprivescwritable
(16)// PrivEsc
BEGINNERwindows
WinPEAS — Windows privilege escalation
Automated Windows privilege escalation enumeration. Checks services, registry, credentials, tokens.
winpeaswindowsprivescautomated
(17)// PrivEsc
INTERMEDIATEwindows
Windows — Check token privileges
Lists current user token privileges. SeImpersonatePrivilege = likely path to SYSTEM.
windowstokenprivilegesimpersonatesystem
(18)// Web
BEGINNERlinuxmacos
SQLMap — Basic SQL injection scan
Automatically detects and exploits SQL injection. --dbs enumerates databases. --batch skips prompts.
sqlmapsqlidatabaseinjection
(19)// Web
BEGINNERlinuxmacos
JWT — Decode token (no verification)
Decodes JWT header and payload without signature verification.
jwtdecodebase64token
(20)// Web
BEGINNERlinuxmacos
LFI — Basic path traversal test
Tests for Local File Inclusion via path traversal to read /etc/passwd.
lfipath-traversalcurllinux
(21)// Web
INTERMEDIATEany
Burp — Match and Replace for security header bypass
Adds or overrides X-Forwarded-For header to simulate localhost access for IP-restricted endpoints.
burpheadersbypassx-forwarded-forlocalhost
(22)// Reverse Eng.
BEGINNERlinuxmacos
File — Identify binary type
Identifies the true file type regardless of extension. ELF, PE, scripts, archives.
filebinaryidentificationstatic
(23)// Reverse Eng.
BEGINNERlinuxmacos
Strings — Extract printable strings from binary
Extracts all printable strings of 8+ chars. Often reveals hardcoded credentials, URLs, C2 addresses.
stringsstatic-analysisbinarycredentials
(24)// Reverse Eng.
INTERMEDIATElinux
Checksec — Check binary protections
Reports enabled security mitigations: ASLR, NX, PIE, stack canaries, RELRO.
checksecbinaryaslrnxpiecanarymitigations
Ghidra — Batch headless analysis
Runs Ghidra analysis without the GUI. Useful for scripting bulk analysis.
ghidraheadlessstatic-analysisdisassembly
(26)// Reverse Eng.
INTERMEDIATElinuxmacos
Radare2 — Open binary and analyze
Opens binary in radare2 with full analysis (-A runs aaa). Start here for interactive disassembly.
radare2r2disassemblystatic-analysis
(27)// Reverse Eng.
INTERMEDIATElinux
GDB + pwndbg — Debug with pwndbg plugin
Opens binary in GDB with pwndbg plugin for enhanced output. Essential for dynamic analysis.
gdbpwndbgdebuggingdynamic-analysisstack
(28)// Reverse Eng.
INTERMEDIATElinux
ltrace — Trace library calls
Intercepts and logs all library function calls (malloc, strcmp, printf, etc.) as the program runs.
ltracelibrary-callsdynamic-analysistracing
(29)// Reverse Eng.
INTERMEDIATElinux
strace — Trace system calls
Intercepts system calls. Filter with -e to focus on specific calls like file opens and network.
stracesyscallsdynamic-analysistracing
(30)// Malware Analysis
BEGINNERwindows
PEStudio — Static PE analysis
Static analysis of PE (Windows) executables. Shows suspicious imports, strings, entropy, digital signature.
pestudiopewindowsstatic-analysisimportsentropy
(31)// Malware Analysis
BEGINNERlinuxwindows
Detect-It-Easy — Packer identification
Identifies packers, compilers, cryptors used on PE files. Tells you if unpacking is needed.
diedetect-it-easypackerpeidentification
ExifTool — Extract metadata from any file
Extracts full metadata from images, PDFs, Office files, audio, video. Second form strips it all.
exiftoolmetadataexifforensicssteganography
(33)// Malware Analysis
INTERMEDIATEwindows
FLARE-VM — Malware analysis sandbox setup (Windows)
Installs FLARE-VM — the complete Windows malware analysis environment with 100+ tools.
flare-vmwindowssandboxsetupmandiant
(34)// Malware Analysis
INTERMEDIATElinuxwindows
Capa — Identify malware capabilities
Identifies capabilities of a PE binary using rules mapped to MITRE ATT&CK and MBC.
capacapabilitiesmitrestatic-analysismandiant
(35)// Forensics
INTERMEDIATElinuxmacos
Volatility 3 — Identify memory profile
Identifies OS version and build from a Windows memory dump.
volatilitymemory-forensicswindowsprofile
(36)// Forensics
INTERMEDIATElinuxmacos
Volatility 3 — List processes
Lists all running processes at time of memory capture. pstree shows parent-child relationships.
volatilitymemory-forensicsprocessespslistpstree
(37)// Forensics
INTERMEDIATElinuxmacos
Volatility 3 — Network connections from memory
Extracts network connections present in memory at time of capture.
volatilitymemory-forensicsnetworkconnectionsnetstat
(38)// Forensics
BEGINNERlinux
Binwalk — Extract embedded files from firmware/binary
Identifies and extracts embedded files (ZIP, gzip, ELF, PNG, etc.) from any binary or firmware.
binwalkfirmwareextractionembeddedctf
(39)// Forensics
INTERMEDIATElinux
Foremost — Carve files from disk image
File carving tool that recovers files from disk images based on headers and footers.
foremostfile-carvingdisk-forensicsrecovery
(40)// Steganography
BEGINNERlinux
Steghide — Extract hidden data from image
Extracts data hidden in JPEG/BMP/WAV files using steghide embedding.
steghideimagejpeghidden-datastegoctf
(41)// Steganography
BEGINNERlinux
Zsteg — LSB stego analysis on PNG/BMP
Detects LSB (Least Significant Bit) steganography in PNG and BMP files.
zsteglsbpngstegoctf
Stegsolve — Visual image analysis (CTF)
GUI tool to analyze image bit planes, color channels, and LSB visually.
stegsolveimagebitplanevisualctf
Sonic Visualiser — Audio spectrogram analysis
Visualizes audio files as spectrograms. Hidden images or text often visible in frequency domain.
sonic-visualiseraudiospectrogramstegoctf
(44)// Cryptography
BEGINNERlinuxwindows
Hashcat — Crack hash with rockyou
Cracks hashes using dictionary attack. -m specifies hash type (0=MD5, 1000=NTLM, 1800=sha512crypt).
hashcatcrackinghashrockyoudictionary
(45)// Cryptography
BEGINNERlinux
John the Ripper — Crack shadow file
Combines passwd and shadow files then cracks with wordlist.
johnshadowpasswdcrackinglinux
(46)// Cryptography
BEGINNERany
CyberChef — Identify encoding chain
Use CyberChef Magic operation to auto-detect and decode unknown encoding chains.
cyberchefencodingbase64rot13magicctf
(47)// Active Directory
INTERMEDIATEwindowslinux
BloodHound — Collect AD data with SharpHound
Collects Active Directory relationship data for BloodHound graph analysis.
bloodhoundsharphoundactive-directoryadgraph
(48)// Active Directory
ADVANCEDlinux
Kerberoasting — Request service tickets
Requests Kerberos service tickets for accounts with SPNs. Cracks offline to get plaintext passwords.
kerberoastingkerberosspnimpacketactive-directory
(49)// DFIR
INTERMEDIATEwindows
Windows — Collect system triage (KAPE)
Collects key forensic artifacts from a live Windows system using KAPE triage collection.
kapewindowstriagecollectiondfirartifacts
(50)// DFIR
INTERMEDIATEwindows
Windows Event Logs — Find logon events
PowerShell: retrieves Windows Security logon events (Event ID 4624). Shows who logged in and when.
windowsevent-logspowershelllogonsecurity4624
Wireshark — Filter HTTP POST requests
Filters captured traffic to show only HTTP POST requests, useful for credential harvesting in DFIR/CTF.
wiresharkhttppcapnetwork-forensicscredentialsfilter
(52)// DFIR
INTERMEDIATElinuxmacos
Tshark — Extract HTTP objects from PCAP
Extracts all HTTP transferred files (images, scripts, executables) from a PCAP capture.
tsharkpcaphttpexportnetwork-forensicsctf
(53)// Scripting
BEGINNERlinuxmacos
Python — Reverse shell one-liner
Python3 reverse shell one-liner. Start a netcat listener before executing on target.
pythonreverse-shellone-linernetcat
(54)// Scripting
INTERMEDIATElinux
Bash — Upgrade to fully interactive TTY
Upgrades a raw netcat shell to a fully interactive TTY with tab completion, Ctrl+C, and clear.
ttyshellupgradeptybashinteractive
(55)// Scripting
INTERMEDIATEwindows
PowerShell — Download and execute in memory
Downloads and executes a PowerShell script entirely in memory without writing to disk.
powershelliexfilelessmemorydownload
(56)// OSINT
INTERMEDIATEany
Shodan — Search for vulnerable services
Shodan searches for internet-exposed services. Useful for recon on target organizations.
shodanosintreconexposed-servicesdorks
(57)// OSINT
BEGINNERlinuxmacos
TheHarvester — Email and subdomain harvesting
Gathers emails, subdomains, IPs, and employee names from public sources.
theharvesteremailssubdomainsosintrecon
(58)// CTF
BEGINNERlinuxmacos
CTF — First steps checklist on any challenge file
Standard first-five-commands methodology for any unknown file in CTF forensics/misc challenges.
ctfmethodologyforensicsfile-analysischecklist
CTF — Common encoding recognition patterns
Quick reference for visually identifying common encoding schemes in CTF challenges.
ctfencodingbase64hexrot13morserecognition
GTFOBins — Quick lookup for privesc via SUID binary
GTFOBins documents how to abuse Unix binaries for privilege escalation, reverse shells, and file reads.
gtfobinssuidprivesclpelinuxctf