pentest_work_tools.cheat

% Pentest work tools from nixos profile

$ target: { [ -f scope.txt ] && tr '[:space:]' '\n' < scope.txt | sed '/^$/d'; printf '%s\n' 127.0.0.1 example.com; } | sort -u
$ domain: { [ -f scope.txt ] && tr '[:space:]' '\n' < scope.txt | sed '/^$/d'; printf '%s\n' example.com; } | sort -u
$ url: { [ -f scope.txt ] && tr '[:space:]' '\n' < scope.txt | sed '/^$/d' | awk '/^https?:\\/\\// { print; next } { print "http://" $0 "/" }'; printf '%s\n' http://127.0.0.1/; } | sort -u
$ wordlist: find "$(pwd)" "$(nix build --impure -I nixpkgs=channel:nixos-unstable --no-link --print-out-paths --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; seclists')/share/wordlists/seclists" "$(nix build --impure -I nixpkgs=channel:nixos-unstable --no-link --print-out-paths --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; wordlists')/share/wordlists" -type f 2>/dev/null | sort -u
$ output_dir: printf '%s\n' ./out
$ file: find "$(pwd)" -type f 2>/dev/null | sort -u; printf '%s\n' ./input.txt
$ username: printf '%s\n' administrator admin user
$ password: printf '%s\n' 'Password123!' password
$ hash: printf '%s\n' 'aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0'
$ interface: ip -o link show 2>/dev/null | awk -F': ' '{print $2}' | cut -d@ -f1 | grep -v '^lo$'; printf '%s\n' eth0 wlan0
$ ports: printf '%s\n' 80,443,8080 1-65535
$ cidr: printf '%s\n' 127.0.0.0/24
$ callback_url: printf '%s\n' http://127.0.0.1:8080
$ tenant: printf '%s\n' tenant.onmicrosoft.com
$ query: printf '%s\n' 'title="index of"'
$ project: printf '%s\n' "$(basename "$PWD")"
$ workspace_dir: printf '%s\n' /mnt/current_pentest "$PWD"

# start the packaged pentest workspace from the nixos flake
nix shell --impure github:esp0xdeadbeef/nixos#pentest-workspace -c start-pentest

# load the pentest workspace tmux dashboard
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ tmux ]' -c nix shell --impure github:esp0xdeadbeef/nixos#pentest-workspace -c sh -c 'cd "$(dirname "$(command -v start-pentest)")"/../share/pentest-workspace/scripts/dashboard-tmux && ./1_spawn-tmuxp.sh && tmux attach'

# run the pentest PowerShell bundle from the nixos flake
nix shell --impure github:esp0xdeadbeef/nixos#pentest-powershell -c pwsh

# autorecon against a target
nix shell --impure github:esp0xdeadbeef/nixos#autorecon -c autorecon <target> -o <output_dir>

# apktool decode APK
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ apktool ]' -c apktool d <file> -o <output_dir>

# dex2jar convert APK/DEX/JAR
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ dex2jar ]' -c d2j-dex2jar <file> -o <output_dir>/classes.jar

# jadx GUI open APK/JAR
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ jadx ]' -c jadx-gui <file>

# ghidra GUI
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ ghidra ]' -c ghidraRun

# cutter GUI
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ cutter ]' -c cutter <file>

# rizin inspect binary
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ rizin ]' -c rizin <file>

# radare2 inspect binary
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ radare2 ]' -c r2 <file>

# mitmproxy web UI
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ mitmproxy ]' -c mitmweb --listen-host 127.0.0.1 --listen-port 8081

# mitmdump upstream proxy capture
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ mitmproxy ]' -c mitmdump --mode upstream:http://127.0.0.1:8080 -p 8081 --ssl-insecure --save-stream-file "+mitmproxy.mitmproxy"

# OWASP ZAP GUI
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ zap ]' -c zap

# OWASP ZAP baseline scan
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ zap ]' -c zap-baseline.py -t <url> -r zap-baseline.html

# wireshark GUI
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ wireshark ]' -c wireshark

# bloodhound GUI
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ bloodhound ]' -c bloodhound

# bloodhound-python collect AD data
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ bloodhound-py ]' -c bloodhound-python -d <domain> -u <username> -p <password> -ns <target> -c All

# azurehound collect Azure data
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ azurehound ]' -c azurehound list --tenant <tenant> -o azurehound.json

# certipy find AD CS issues
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ certipy ]' -c certipy find -u <username> -p <password> -target <target> -dc-ip <target> -vulnerable -stdout

# evil-winrm connect
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ evil-winrm ]' -c evil-winrm -i <target> -u <username> -p <password>

# responder on interface
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ responder ]' -c responder -I <interface> -A

# pretender listen on interface
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ pretender ]' -c pretender -i <interface>

# mitm6 on domain
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ mitm6 ]' -c mitm6 -d <domain>

# impacket smbserver current directory
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ python3Packages.impacket ]' -c impacket-smbserver share "$(pwd)" -smb2support

# impacket secretsdump with password
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ python3Packages.impacket ]' -c impacket-secretsdump '<domain>/<username>:<password>@<target>'

# impacket secretsdump with hash
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ python3Packages.impacket ]' -c impacket-secretsdump -hashes <hash> '<domain>/<username>@<target>'

# netexec smb basic auth
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ netexec ]' -c nxc smb <target> -u <username> -p <password>

# enum4linux-ng full enum
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ enum4linux-ng ]' -c enum4linux-ng -A <target>

# nbtscan CIDR
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ nbtscan ]' -c nbtscan <cidr>

# sipvicious scan
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ sipvicious ]' -c svmap <target>

# hydra SSH
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ hydra ]' -c hydra -l <username> -P <wordlist> ssh://<target>

# hashcat benchmark
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ hashcat ]' -c hashcat -b

# hash identifier
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ hash-identifier ]' -c hash-identifier

# hashid identify hash
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ hashid ]' -c hashid <hash>

# haiti identify hash
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ haiti ]' -c haiti <hash>

# name-that-hash identify hash
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ nth ]' -c nth --text <hash>

# hcxdumptool capture
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ hcxdumptool ]' -c hcxdumptool -i <interface> -w capture.pcapng

# hcxpcapngtool convert capture
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ hcxtools ]' -c hcxpcapngtool -o hashes.22000 <file>

# nuclei scan URL
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ nuclei nuclei-templates ]' -c nuclei -u <url>

# httpx probe URLs/domains
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ httpx ]' -c httpx -u <url> -title -tech-detect -status-code

# naabu scan ports
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ naabu ]' -c naabu -host <target> -p <ports>

# tlsx inspect TLS
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ tlsx ]' -c tlsx -u <domain> -san -cn -tls-version

# sslscan target
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ sslscan ]' -c sslscan <target>

# testssl target
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ testssl ]' -c testssl <target>

# whatweb URL
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ whatweb ]' -c whatweb <url>

# nikto URL
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ nikto ]' -c nikto -h <url>

# sqlmap URL
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ sqlmap ]' -c sqlmap -u <url> --batch

# dalfox URL
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ dalfox ]' -c dalfox url <url>

# hakrawler URL
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ hakrawler ]' -c hakrawler -url <url>

# katana URL crawl
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ katana ]' -c katana -u <url>

# gau domain URLs
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ gau ]' -c gau <domain>

# waybackurls domain URLs
NIXPKGS_ALLOW_UNFREE=1 nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ waybackurls ]' -c waybackurls <domain>

# cariddi URL crawl
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ cariddi ]' -c cariddi -u <url>

# gowitness screenshot URL
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ gowitness ]' -c gowitness scan single --url <url> --screenshot-path <output_dir>

# subfinder domain
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ subfinder ]' -c subfinder -d <domain>

# subjack subdomain takeover scan
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ subjack ]' -c subjack -w <file> -t 100 -timeout 30 -ssl -v

# amass passive domain
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ amass ]' -c amass enum -passive -d <domain>

# dnsx resolve domain list
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ dnsx ]' -c dnsx -d <domain> -a -resp

# shuffledns resolve domain with wordlist
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ shuffledns ]' -c shuffledns -d <domain> -w <wordlist> -r <file>

# massdns resolve file
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ massdns ]' -c massdns -r <file> -t A -o S -w massdns.out <file>

# alterx generate permutations
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ alterx ]' -c alterx -l <file> -o alterx.out

# asnmap ASN/CIDR lookup
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ asnmap ]' -c asnmap -d <domain>

# mapcidr expand CIDR
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ mapcidr ]' -c mapcidr -cidr <cidr>

# cdncheck target
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ cdncheck ]' -c cdncheck -i <target>

# cloudlist assets
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ cloudlist ]' -c cloudlist -silent

# cvemap search CVEs
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ cvemap ]' -c cvemap -q <query>

# uncover search
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ uncover ]' -c uncover -q <query>

# interactsh client
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ interactsh ]' -c interactsh-client

# notify stdin
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ notify ]' -c sh -c 'printf "%s\n" "message from <project>" | notify'

# proxify HTTP proxy
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ proxify ]' -c proxify -http-proxy 127.0.0.1:8080

# qsreplace parameter replacement
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ qsreplace ]' -c sh -c 'printf "%s\n" "<url>" | qsreplace FUZZ'

# gitleaks detect secrets
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ gitleaks ]' -c gitleaks detect --source . --no-git

# trufflehog filesystem scan
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ trufflehog ]' -c trufflehog filesystem .

# bruno API client
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ bruno ]' -c bruno

# objection explore app
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ objection ]' -c objection -g <target> explore

# frida trace target
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ frida-tools ]' -c frida-trace -U -f <target>

# oletools VBA macro analysis
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ oletools ]' -c olevba <file>