What does this tool do?
The Pentest Cheat Sheet (Command Reference) gathers an end-to-end penetration testing workflow for OSCP/HTB/THM into 11 searchable phases, with a one-line explanation of what each command does. It covers recon/enumeration (nmap, rustscan, autorecon), SMB (smbclient, crackmapexec, enum4linux), web (feroxbuster, ffuf, nikto, sqlmap), password attacks (hydra, john, hashcat), reverse shells and TTY upgrade, file transfer, Linux/Windows privesc, Active Directory (bloodhound, GetNPUsers, GetUserSPNs, secretsdump, evil-winrm) and pivoting (ssh -L/-D, proxychains, chisel). Everything runs in your browser with no data sent to a server; it is intended for authorized testing and educational use only.
How to use it
- Enter your listener IP and port.
- Pick the command or payload that fits your setup.
- Copy it and use it only on systems you are authorized to test.
Organised by phase
The cheat sheet is split into 11 phases following the natural order of an engagement: recon, port scanning, service enumeration, web, password cracking, initial access, file transfer, local privesc, Active Directory and pivoting. Search the command you need (e.g. 'GetUserSPNs.py' or 'feroxbuster -u') to copy the exact syntax and a one-sentence explanation, so during an exam you rely on quick reference instead of memory.
Typical use
Starting an HTB box you begin with 'nmap -sC -sV -p- 10.10.10.10' to see open services, then move to 'crackmapexec smb' for SMB or 'feroxbuster' for web. After a foothold you upgrade the shell with 'python3 -c pty.spawn', run 'linpeas.sh' or 'winPEAS', and in an AD environment map attack paths with 'bloodhound-python' — all in one ordered reference.
Frequently asked questions
What order should I do a pentest in?
The general flow is: recon and port scanning first (nmap), then enumerate each open service (SMB, web, etc.), find a weakness and gain a foothold, then escalate privileges locally, and finally move laterally/vertically (pivoting, AD). Each phase can surface new info (usernames, passwords, hashes) that sends you back to an earlier step — enumeration is continuous.
How do I upgrade a shell to a full TTY?
After catching a dumb shell, run 'python3 -c "import pty;pty.spawn(\'/bin/bash\')"', background it with Ctrl+Z, then run 'stty raw -echo; fg' and 'export TERM=xterm'. You now get full terminal features like arrow keys, tab completion, Ctrl+C and clear.
What is Kerberoasting?
Kerberoasting requests Kerberos TGS tickets for Active Directory service accounts that have an SPN, then cracks offline the portion encrypted with that account's NTLM hash. Request tickets with 'GetUserSPNs.py -request' and crack with hashcat mode 13100; it is very effective because service accounts often have weak passwords.
Is Pentest Cheat Sheet (Command Reference) free?
Yes. Pentest Cheat Sheet (Command Reference) and all 300+ tools on MagmaNex are completely free with no signup or account required.
Is my data safe?
Yes. Everything runs locally in your browser. The data you enter is never sent to a server, stored, or shared.
Does it work on mobile?
Yes. Pentest Cheat Sheet (Command Reference) works on phones, tablets and desktops — no app download needed.
🔒 Privacy: everything runs in your browser, your data is never sent to a server.