Tools — Master Hub
All tool documentation lives under Sheet/Tools/, grouped by what you’re trying to do — not by individual command.
How to use: Pick your phase → open the category hub → drill into the specific tool note.
Fresh Kali / missing tool? → Installation - Kali Setup (per-tool) · Install Download and Run (how-to: git, .deb, PATH)
📌 Folder Map
| Folder | When to use | Hub |
|---|---|---|
| Linux Tools | Shell on Linux, parse output, transfer files, stego | Linux Tools |
| Recon | Scanning, directory brute, web enum, SQLi automation | Recon |
| Active Directory | Kerberos, NTLM capture, BloodHound, cred attacks on AD | Active Directory |
| Remote Access | SSH, WinRM, RDP, pivoting, FTP | Remote Access |
| Password Attacks | Crack hashes, spray/brute logins | Password Attacks |
| Database | MySQL, MSSQL, Postgres, Redis, MongoDB, Oracle | Database |
| Impacket | Windows protocol scripts — shells, dumps, Kerberos, relay | Impacket |
| MetaSploit | msfconsole, msfvenom, meterpreter, payloads | MetaSploit |
| SMB | SMB enum, shares, CrackMapExec, rpcclient | SMB |
| Cloud | AWS CLI — S3/MinIO, custom endpoints | Cloud |
| Installation - Kali Setup | apt / pip / git install commands for all tools | Installation - Kali Setup |
| Install Download and Run | How to install anything — .deb, clone, PATH, pip . | Install Download and Run |
📌 OSCP Phase → Tools
RECON → [[Nmap]] [[RustScan]] [[searchsploit]] [[Gobuster]] [[ffuf]] [[CMSeeK - cmseek]] [[Burp Suite]] [[DNS (dig & host)]] [[ldapsearch]] [[snmpwalk]] [[Kerbrute]]
WEB EXPLOIT → [[SQLMap]] [[Burp Suite]] [[Curl]]
CREDS / AD → [[Responder]] [[Kerberoast]] [[Rubeus]] [[Certipy & Certify]] [[SharpHound]] [[RustHound]] [[bloodyAD]] [[PowerSploit]] [[PowerView]] [[Impacket]] [[Hashcat]]
ACCESS → [[SSH]] [[evil-winrm]] [[xfreerdp]] [[Netcat]] [[Penelope]] [[rlwrap]]
PIVOT → [[Chisel]] [[SSH]] (see [[Tunneling]])
LINUX BOX → [[Text Processing]] [[find]] [[grep]] [[OpenSSL]] [[exiftool]] [[File Transfer]] [[Privesc Tools]]
DATABASE → [[Database]]
CLOUD / S3 → [[AWS CLI]]
📌 Quick Links — Most Used
| Tool | Category |
|---|---|
| Nmap | Recon |
| RustScan | Recon (fast port scan) |
| searchsploit | Recon |
| Gobuster | Recon |
| CMSeeK - cmseek | Recon (CMS detection) |
| ffuf | Recon |
| Burp Suite | Recon / Web |
| SQLMap | Recon / Web |
| Impacket | AD / Lateral |
| evil-winrm | Remote Access |
| Hashcat | Password Attacks |
| Hydra | Password Attacks |
| CeWL | Password Attacks (site spider wordlist) |
| Text Processing | Linux Tools |
| Pipelines & Chaining | Linux Tools |
| Responder | Active Directory |
| Kerberoast | Active Directory |
| Rubeus | Active Directory (Windows Kerberos) |
| Certipy & Certify | Active Directory (AD CS) |
| Pidgin | Recon (XMPP / 5222) |
| ldapsearch | Recon (LDAP / 389) |
| File Transfer | Linux Tools (move payloads) |
| Git & GitHub | Linux Tools — exposed .git, git log, GitHub OSINT |
| OpenSSL | Linux Tools (TLS, certs, passwd, crypto) |
| exiftool | Linux Tools (metadata / EXIF) |
| pypykatz | Active Directory (offline LSASS parser) |
| Privesc Tools | Post-Exploitation (LinPEAS/WinPEAS) |
| Restricted Shell Escape | Post-Exploitation (rbash / vi escape) |
| SharpHound | Active Directory (BloodHound collector — Windows) |
| RustHound | Active Directory (BloodHound collector — Rust/Linux) |
| bloodyAD | Active Directory (LDAP write / ACL abuse) |
| krb5-user | Active Directory (kinit, kpasswd — port 464) |
| PowerSploit | PowerShell offensive framework (PowerView, PowerUp) |
| PowerView | Active Directory PS enum (Recon) |
| PowerUp | Windows local privesc (PowerShell) |
| PowerUpSQL | MSSQL attack toolkit (Lateral movement) |
| Penelope | Remote Access (shell handler — prefer over rlwrap nc) |
| rlwrap | Linux Tools (shell listener) |
| AWS CLI | Cloud (S3/MinIO buckets) |
| PowerShell Cmdlets | Commands (PS hub) |
| snmpwalk | Recon (SNMP / 161) |
| Mail (SMTP POP3 IMAP) | Recon (SMTP/POP3/IMAP) |
| BeanShooter | Recon / Exploit (JMX / 1099) |
| nbtscan | Recon (NetBIOS / 137-139) |
Related Tools
- Nmap
- Impacket
- CrackMapExec - nxc
- nxcspray
- Hashcat
- evil-winrm
- UseCases for ports
- Linux Tools
- MetaSploit
Related Notes
- Sheet
- Initial foothold
- Linux (privesc concepts)
- AD
- Tunneling
- Training
- Basic Commands