10.0 Cheatsheet Index
Complete operational task index — every procedure and task, searchable by service or technique.
Use these sheets for fast execution. Open Master Notes for mechanisms and the linked reference pages for complete procedures.
For concept study, follow the grouped study sequence. The numbered blocks and stage pages remain stable lookup units; the grouped units join decisions that should be rehearsed as one attack path.
Tools and scripts by task — direct upstream links and the owning procedure for each tool.
10.0.1 Discovery and scanning
The topic sheets include “Discover and recognize candidates” sections: discovery actions, recognition cues and checks before selection. For full synthetic evidence and decision examples, open the method discovery workflows; test your reasoning with unanswered recognition practice.
| Question | Sheet |
|---|---|
| How do I turn an assigned IP into an attack-surface queue? | Discovery and scanning |
| Which TCP/UDP command fits this source and coverage requirement? | Discovery and scanning — command chooser |
| What does this port state establish, and what is still unknown? | Discovery and scanning — state decisions |
| When should I rescan or re-enumerate? | Discovery and scanning — rescan triggers |
10.0.2 Service enumeration
| Question | Sheet |
|---|---|
| How do I turn a confirmed service into information or access? | Service opportunity decision loop |
| How do I enumerate FTP, SSH, SMTP, DNS, NFS, SMB or SNMP? | Service opportunity cheatsheet |
| How do I inspect an rsync daemon or retrieve a known file over TFTP? | Service opportunity cheatsheet — conditional file services |
| How do I enumerate MySQL, MSSQL or PostgreSQL privileges? | Determine which database data and operations your identity can access |
| How do I validate RDP or WinRM access? | Validate the remote services your Windows identity can access |
| What requires re-enumeration immediately? | New-state triggers |
10.0.3 Web mapping and exploitation
| Question | Sheet |
|---|---|
| How do I turn one HTTP endpoint into a route/input/role map? | Web mapping |
| How do I enumerate content, virtual hosts, parameters and APIs? | Web mapping procedures |
| How do I distinguish traversal, inclusion, upload and execution? | Web exploitation — file paths and uploads |
| How do I test visible or blind command injection? | Web exploitation — command injection |
| How do I manually test error, UNION or blind SQL injection? | Web exploitation — manual SQL injection |
| How do I validate IDOR, role logic, mass assignment or useful XSS? | Web exploitation — access control and XSS |
| How do I validate SSTI, XXE, NoSQL operators, unsafe deserialization/YAML or Shellshock without guessing? | Web exploitation — conditional parser and template primitives |
| How do I select, audit, compile or repair a public exploit? | Public exploit adaptation |
10.0.4 Shells, transfers and credentials
| Question | Sheet |
|---|---|
| Which reverse/bind shell fits the available interpreter and route? | Shells and payloads |
| How do I repair a Linux TTY or diagnose a missing callback? | Shells and payloads |
| Does this listener require Netcat, Ncat or a matching staged handler? | Shells and payloads — listeners and payloads |
| Why did a document, shortcut, script or binary fail before a usable session? | Payload execution obstacles |
| How do I distinguish MOTW, execution policy, AMSI, AppLocker/WDAC, Defender and architecture failures? | Payload execution — evidence router |
How do I configure msfvenom, multi/handler and sessions without crossing the exam boundary? | Payload execution — Metasploit workflow |
| Is this an NT hash, Net-NTLMv2 response, ticket, key or file verifier? | Credentials and cracking |
How do I use Hashcat/John or a *2john converter? | Credentials and cracking |
| How do I validate a password, run a bounded dictionary/spray or interpret failure? | Credentials and cracking — online validation |
| How do I inspect or use an SSH key, NT hash, Net-NTLMv2 response, DCC2 value or Kerberos cache? | Credentials and cracking — typed workflows |
| How do I transfer tools/evidence and verify integrity? | File-transfer procedure |
10.0.5 Local privilege escalation
| Question | Sheet |
|---|---|
| What is the Linux first pass and candidate-proof model? | Linux privilege escalation |
| How do I check sudo, SUID/capabilities, cron/systemd, PATH, wildcards and libraries? | Linux privilege escalation |
| How do I validate Docker/LXD, mounts/NFS, local services or an automated finding? | Linux privilege escalation |
| What is the Windows first pass and candidate-proof model? | Windows privilege escalation |
| How do I check credentials, services, unquoted paths, tasks and token privileges? | Windows privilege escalation |
| How do I prove DLL search, AlwaysInstallElevated or UAC context without a false positive? | Windows privilege escalation |
| Which impersonation, backup, restore, debug, ownership or driver privilege branch applies? | Windows privilege escalation |
10.0.6 Active Directory and lateral movement
Quick AD enumeration and lateral movement commands — Windows starting context, one inline LDAP helper and precise next checks.
| Question | Sheet |
|---|---|
| Where should I look first, and what does the AD output establish? | AD investigation command-and-interpretation chooser |
| Which AD method fits my access, and how can I test my interpretation? | Method comparison / Unanswered cases |
| How do I map domain identity, shares, SPNs, ACLs and BloodHound edges? | Active Directory |
| How do I request AS-REP/TGS material and handle tickets? | Active Directory |
| How do I inspect credential sources, AD CS and DCSync prerequisites? | Active Directory |
| Which remote execution method matches password, hash or ticket access? | Active Directory — lateral movement chooser |
10.0.7 Pivoting and evidence
| Question | Sheet |
|---|---|
| Which SSH, Chisel or Ligolo-ng route should I build? | Pivoting and tunneling |
| What should I capture at each access/privilege transition? | Evidence and reporting |
| How do I rank paths, route state changes and recover from a dead end? | Integrated attack and reporting |
| Which baseline tool answers the current question? | Choose tools that match your task and constraints |
| What is the baseline invocation for every getSH-listed tool? | Find commands for the task you are trying to complete |
This index contains only populated sheets. Detailed source accounting for the imported getSH material is in the getSH coverage map.