A personal, command-first reference for the Certified Penetration Testing Specialist (CPTS) job-role path. Organized by attack phase, written for fast recall during boxes and exam preparation.
Use only against systems you have explicit written authorization to test. This is a study and engagement reference; misuse against unauthorized targets is illegal in most jurisdictions.
| Phase | Modules |
|---|---|
| Foundations | 01 · 02 · 03 · 04 · 05 · 06 · 07 · 08 · 09 |
| Recon & Enumeration | 10 Nmap · 11 Footprinting · 12 Web Recon |
| Pre-Exploit | 13 File Transfers · 14 Vuln Assessment · 15 Shells & Payloads · 16 Metasploit |
| Exploitation & Lateral | 17 Password Attacks · 18 Common Services · 19 Pivoting · 20 AD Attacks |
| Web Exploitation | 21 Web Proxies · 22 FFuF · 23 Login Brute Force · 24 SQLi · 25 SQLMap · 26 XSS · 27 File Inclusion · 28 File Upload · 29 Command Injection · 30 Web Attacks · 31 Common Apps |
| Post-Exploit | 32 Linux Privesc · 33 Windows Privesc |
| Reporting & Capstone | 34 Reporting · 35 Enterprise Methodology |
- Quick commands — most-used one-liners across all phases
- References — canonical external resources
| I want to… | Go to |
|---|---|
| Pick the right reverse shell | 15 Shells & Payloads |
| Look up a SUID binary | GTFOBins + 32 Linux Privesc |
| Look up a Windows abuse path | LOLBAS + 33 Windows Privesc |
| Identify a hash | 17 Password Attacks |
Pick an nmap invocation |
10 Nmap |
Build a msfvenom payload |
15 Shells & Payloads |
| Pivot through a host | 19 Pivoting |
| Plan an AD attack chain | 20 AD Attacks |
| Structure a finding | 34 Reporting |
| Run an end-to-end engagement | 35 Enterprise Methodology |
$prefix → unprivileged shell,#→ root/admin,PS>→ PowerShell,mimikatz #→ mimikatz prompt.<TARGET>,<RHOST>,<LHOST>,<USER>,<PASS>,<DC>,<DOMAIN>are placeholders — substitute before running.- Code blocks are tagged with the language they should be executed in (
bash,cmd,powershell,sql, etc.). - Sources are listed at the bottom of every module file.
- Cross-references between modules are relative links.
All content is original prose written from public references. Each module lists its sources. The repo is MIT-licensed — see LICENSE. Use it, fork it, modify it, share it.
External resources cited throughout:
- HackTricks — community-curated pentest reference
- The Hacker Recipes — particularly strong on AD
- PayloadsAllTheThings — payload library (MIT)
- PortSwigger Web Security Academy — web vuln theory
- OWASP — testing guide, cheat sheets, ASVS
- GTFOBins — Linux privesc lookup
- LOLBAS — Windows binary abuse lookup
- WADComs — Windows AD/network commands lookup
- Tool docs: nmap.org, sqlmap.org, hashcat.net, openwall.com/john, NetExec wiki, Impacket, BloodHound, Metasploit
- RFCs and Microsoft Learn for protocol-level details
Personal repo, but issues and PRs are welcome:
- Found a typo or broken command? Open a PR.
- Found that a command doesn't work with a newer tool version? Open an issue with the version + corrected syntax.
- Want to add a technique? Open an issue first to discuss scope. Keep it command-first; teaching prose belongs in source course material, not here.
- Do not submit content copied from any paid course (HTB Academy, OffSec, Zero-Point Security, etc.).
This material is for educational use, authorized penetration testing, and Capture-The-Flag exercises. The author is not responsible for misuse. Always verify scope and authorization before running any command from this cheatsheet against a target.