Hacker Cheatsheet

This repository serves as a comprehensive compilation of notes and commands assembled during preparation for the Offensive Security Certified Professional (OSCP) certification, specifically the PEN-200 course taken in 2025.

The purpose of this cheatsheet is to provide a structured and concise reference to aid in the understanding and execution of various penetration testing techniques covered in the OSCP curriculum.

Contents

• Penetration Testing with Kali Linux: General Course Information
  • Getting Started with PWK
    • PWK Course Materials
    • Connecting to the PWK Lab
• Introduction To Cybersecurity
  • The Practice of Cybersecurity
    • On Emulating the Minds of our Opponents
  • Threats and Threat Actors
    • Recent Cybersecurity Breaches
  • The CIA Triad
    • Balancing the Triad with Organizational Objectives
  • Security Principles, Controls, and Strategies
    • Logging and Chaos Testing
  • Cybersecurity Laws, Regulations, Standards, and Frameworks
    • Anatomy of Cyber
  • Career Opportunities in Cybersecurity
    • Additional Roles
• Effective Learning Strategies
  • Learning Theory
    • The Forgetting Curve and Cognitive Load
  • Unique Challenges to Learning Technical Skills
    • The Challenges of Remote and Asynchronous Learning
  • OffSec Training Methodology
    • The Demonstration Method
    • Contextual Learning and Interleaving
  • Case Study: chmod -x chmod
    • What is Executable Permission?
    • Going Deeper: Encountering a Strange Problem
    • One Potential Solution
    • Analyzing this Approach
• Report Writing for Penetration Testers
  • Understanding Note-Taking
    • The General Structure of Penetration Testing Notes.md
    • Choosing the Right Note-Taking Tool
    • Tools to Take Screenshots
  • Writing Effective Technical Penetration Testing Reports
    • Executive Summary
    • Technical Summary
    • Appendices, Further Information, and References
• Information Gathering
  • Passive Information Gathering
    • Whois Enumeration
    • Google Hacking
    • Netcraft (Wappalyzer)
    • Open-Source Code (GitHub, GitHub Gist, GitLab, SourceForge)
    • Passive LLM-Aided Enumeration
  • Active Information Gathering
    • DNS Enumeration
    • TCP-UDP Port Scanning Theory
    • Port Scanning with Nmap
    • SMB Enumeration
    • SMTP Enumeration
    • SNMP Enumeration
    • Active LLM-Aided Enumeration
• [Vulnerability Scanning]
  • Vulnerability Scanning Theory
    • How Vulnerability Scanners Work
    • Types of Vulnerability Scans
    • Things to consider in a Vulnerability Scan
  • Vulnerability Scanning with Nessus
    • Installing Nessus
    • Nessus Components
    • Performing a Vulnerability Scan
    • Analyzing the Results.md
    • Performing an Authenticated Vulnerability Scan
    • Working with Nessus Plugins
  • [Vulnerability Scanning with Nmap]
    • NSE Vulnerability Scripts.md
    • [Working with NSE Scripts.md]
• Introduction to Web Application Attacks
  • Web Application Assessment Tools
    • Fingerprinting Web Servers with Nmap
    • Directory Brute Force with Gobuster
    • Security Testing with Burp Suite
  • Web Application Enumeration
    • Inspecting HTTP Response Headers and Sitemaps
    • Enumerating and Abusing APIs
  • Cross-Site Scripting
    • Basic XSS
    • Privilege Escalation via XSS
• [Common Web Application Attacks]
  • [Directory Traversal]
    • Absolute vs Relative Paths
    • Identifying and Exploiting Directory Traversals
    • [Encoding Special Characters]
  • [File Inclusion Vulnerabilities]
  • [File Upload Vulnerabilities]
  • [Command Injection]
• [SQL Injection Attacks]
• [Phishing Basics]
• [Client-side Attacks]
• [Locating Public Exploits]
• [Fixing Exploits]
• [Antivirus Evasion]
• [Password Attacks]
• [Windows Privilege Escalation]
• [Linux Privilege Escalation]
• [Port Redirection and SSH Tunneling]
• [Tunneling Through Deep Packet Inspection]
• [The Metasploit Framework]
• [Active Directory Introduction and Enumeration]
• [Attacking Active Directory Authentication]
• [Lateral Movement in Active Directory]
• [Enumerating AWS Cloud Infrastructure]
• [Attacking AWS Cloud Infrastructure]
• [Assembling the Pieces]