OSCP cheat sheet

Help articles :
https://shawnvoong.medium.com/how-to-pass-the-2023-oscp-pen-200-on-the-first-try-part-1-enumeration-a0b272a86cf7

____--------------____--------$___-----
Service and Ports: \\\\
This is the best command to use:
nmap -p- -sV -sC -v <IPADDRESS> —open -oN tcpfull.nmap ##TCP
another best one and faster:
nmap -p- --min-rate 5000 -T4 <ip adress>
then for open ports
nmap -sC -sV -p $ports $ip


ADVANCED:
ports=$(nmap -p- --min-rate=1000 -T4 10.10.10.248 | grep ^[0-9] | cut -d '/' -f1 | tr
'\n' ',' | sed s/,$//)
nmap -sC -sV -p$ports 10.10.10.248

udp:
sudo nmap -p 53,67,68,69,111,123,161,162,137,138,139,514,1900,5353,500,445 -sU <IPADDRESS> -oN udp.nmap

If you wish to use autorecon, this is the command I would use to skip Nikto and I use dirsearch as the directory searching tool:

autorecon — nmap-append=” — min-rate=2000" — exclude-tags=”top-100-udp-ports” — exclude-tags nikto — dirbuster.threads=40 — dirbuster.tool=dirsearch -vv <IP>

Web Application Enumeration and Attacks:

you should google them — for example if you see “Gunicorn 20.0.4” running on HTTP, google that along with the word “exploit” or “RCE” or “github”.

If it’s a webpage showing a service and version, google that service to see that the default credentials are. I would often look in searchsploit or google “service + hacktricks”, or “service + pentesting” or “service + hack the box” to see if anything would come back.

OSCP Chapter 8 (Introduction to Web Application Attacks), Chapter 9 (Common Web Application Attacks) and Chapter 10 (SQL Injection Attacks)

Assuming you probably see port 80, 8000, 443 or some other 8XXX port etc, based on your nmap scans you should see the host name, don’t forget to add it to your /etc/hosts file. For example if your nmap scan happens to show: “ Location: https://msxx.host.name:8000/login”, don’t forget to add “msxx.host.name” in the hosts file. It can make a big difference when dir searching.
////
PIVOTING ////
PING SWEEP # for discovering hosts
On Linux:
1. one octet
 for i in {1..254} ;do (ping -c 1 -W 1 192.168.1.$i | grep "bytes from" &) ;done

2. two octets
for i in {1..254}; do
    for j in {1..254}; do
        (ping -c 1 192.168.$i.$j | grep "bytes from" &)
    done
done

On Windows: one octet
You can save it as bat or copy promptly in cmd
1.
for /L %i in (1,1,255) do @ping -n 1 -w 200 192.168.1.%i > nul && echo 192.168.1.%i is up.

2. two octets
for /L %%i in (1,1,254) do (
    for /L %%j in (1,1,254) do (
        @ping -n 1 -w 200 192.168.%%i.%%j > nul && echo 192.168.%%i.%%j is up.
    )
)
---------------------------------------------
NMAP FILE:
https://github.com/andrew-d/static-binaries/blob/master/binaries/linux/x86_64/nmap