PT+ 4 · Nmap, Netcat & Commands

Nmap -sn

Host discovery / ping sweep only (skip port scan)

Nmap -Pn

Skip host discovery; treat all hosts as up

Nmap -PR

ARP ping host discovery on the local subnet

Nmap -p

Port selection: range -p 512-2000, list -p 22,80,443, all -p-

Nmap -sS

SYN scan (default when run as root)

Nmap -sT

Full TCP connect scan

Nmap -sU

UDP scan

Nmap -sA

ACK scan; maps firewall rules, not open ports

Nmap -sF / -sN / -sX

Stealth FIN / NULL / Xmas scans

Nmap -sV

Service/version detection

Nmap -O

OS detection (TCP/IP stack fingerprinting)

Nmap -oX / -oA

Output XML / all formats at once

Nmap NSE (--script)

Nmap Scripting Engine (Lua) for enum/vuln/brute

Nmap -T1

Slow timing; rate-limits and evades IDS

Nmap gets no response

Try another scan type (e.g. TCP ACK) to check for ICMP blocking; don't assume offline

Nmap recon order

Host discovery, then SYN + -O + -sV, review ports, run NSE scripts, save XML

Netcat listener command

nc -l -p 8080

Netcat reverse shell on Windows

nc -e cmd.exe

Netcat port-scan flags

nc -zv 1-1024

PsExec -s flag

Runs the remote process as NT AUTHORITY\SYSTEM

Run Nmap from Metasploit

db_nmap -sV -sC

List NTFS alternate data streams

dir /r report.txt

Open a named ADS text stream

notepad "c:file1:file2.txt"

Extract URLs from a binary (Windows)

strings file.exe | findstr "http"

Hashcat dictionary attack command

hashcat -m 1000 -a 0 hash.txt wordlist.lst

Shodan query for a port on a subnet

port:1194 net:8.8.8.0/24

Bash increment a variable

let count=count+1

Clear bash history (cover tracks)

cat /dev/null > ~/.bash_history

Linux hash prefix $1

MD5

Linux hash prefix $2a

Blowfish

Linux hash prefix $5

SHA-256

Linux hash prefix $6

SHA-512

net view /domain

Lists hosts in a domain

URL-encoded directory traversal

%2E%2E%2F decodes to ../

Command chaining operators

; && |