Ethical Hacking Commands Cheatsheet

A curated, safe reference of common recon, enumeration, and system-inspection commands. Authorized use only.

Curated safe cheatsheet — authorized use only. Only run these commands against systems and domains you own or have explicit written permission to test.

Recon

whois target.com
# Domain registration info
 
nslookup target.com
# DNS lookup
 
dig target.com
# Detailed DNS records
 
traceroute target.com
# Network path

Enumeration

theHarvester -d target.com -b google
# Public emails & subdomains
 
dnsenum target.com
# DNS enumeration
 
sublist3r -d target.com
# Find subdomains
 
wget --spider -r target.com
# Crawl structure

Network Analysis

nmap -sV target.com
# Detect services
 
arp -a
# View ARP cache
 
tcpdump -i eth0
# Capture traffic
 
nc -zv target.com 22
# Check open port

Web Checks

whatweb target.com
# Identify technologies
 
nikto -h http://target.com
# Server checks
 
curl -I http://target.com
# Inspect headers
 
curl -s http://target.com | grep "admin"
# Search page content

System Inspection

uname -a
# System info
 
cat /etc/passwd
# View users
 
ps aux | grep process
# Find process
 
dmesg | tail
# Recent kernel messages

File / Firewall

iptables -L
# View firewall rules
 
scp file.txt user@target.com:/home/user/
# Secure transfer
 
shred -u file.txt
# Secure delete
 
gpg --decrypt file.gpg
# Decrypt owned file