# \*Favorites

## Commands

```
nmap -v -sn $IP                    ..Pings
nmap -v -sn 10.0.0.0/24            ..Pings
nmap -sV -A -oA nmap -p 22,80 $IP  ..Version Scripts Outs
nmap -p0-65535 -Pn -sT $IP         ..All TCP NoPing
nmap -p0-65535 -Pn -sU $IP         ..All UDP NoPing
nmap -A -sT -T4 -Pn -oA nmap $IP   ..NSE/Def TCP Fast Outs NoPing
nmap -Pn --script vuln $IP         ..vul/cve NoPing

wget -q --server-response https://$IP

dirb $IP
dirb http://$IP/admin -w      ..to follow other paths

gobuster dir -u http://$IP -w ..directory-list-2.3-medium.txt
gobuster dir -u https://$IP --noprogress --wordlist ..medium.txt -k
gobuster dir -u https://$IP -w ..medium.txt -k -x php,txt,bak,conf
gobuster dir -u http://$IP/cgi-bin/ -x sh,cgi,pl,py,php -w ..
gobuster -e -u 10.x.x.x:443 -w ..medium.txt -t 50 -o gobuster.log
gobuster dir -u http://$IP/admin -w ..

nikto -host http://$IP    ..might find LFI
nikto -host http://$IP/mypage/index.php

python cmsmap.py -t https://$IP -f W -F --noedb    ..try this!!

wpscan --url https://$IP
wpscan --url https://$IP --disable-tls-checks
wpscan --url https://$IP/wp/ --enumerate p
wpscan --url https://$IP -U elliot --passwords pw.dic

searchsploit linux kernel 2.6.32 priv esc 
searchsploit -x 41006.txt ..read/explain docs/poc 
searchsploit -m 40839.c   ..download the exploit

LFI Scans:
python fi-cyberscan.py -t http://$IP/cyber.php?page= -m1
fimap -u $IP  ..in kali
```

## logme

* **script** - works like a new shell
* Writes all output to a script file, and preserves formatting
* Even logs reverse shell locally.
* Could save this to \~/.bashrc
* Usage:
  * logme - start
  * scriptfile - view current file/save
  * cat myscriptfile - view data

```
logme () { export SCRIPTFILE="$(date +%s)-${$}" echo "Starting tty logging to ~/scripts/${SCRIPTFILE}..." script -c /bin/bash -q "~/scripts/${SCRIPTFILE}" } scriptfile () { echo "${SCRIPTFILE}"; }
```

## Autorecon - try this!

```
sudo python3 autorecon.py $IP -o /home/beep/
```


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://pentest.mxhx.org/02-scanning/start.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.