Playbook - Quick Reference Cheatsheets for Offensive Security Practitioners

#External Focused Enumeration

Web Enumeration

Enumerate directories and files exposed by a web application.

gobuster dir -u https://target -w wordlist.txt

Fuzz URL paths to identify hidden endpoints and parameters.

ffuf -u https://target/FUZZ -w wordlist.txt

Enumerate HTTP methods supported by a web server.

curl -X OPTIONS https://target

Identify application routes and behaviors by inspecting responses.

curl -s https://target | less

Enumerate API routes and versions.

ffuf -u https://api.target/FUZZ -w api.txt

Enumerate GraphQL schema via introspection.

curl -X POST https://target/graphql -d '{"query":"{__schema{types{name}}}"}'

Authentication Enumeration

Enumerate exposed login endpoints and auth flows.

ffuf -u https://target/FUZZ -w auth.txt

Test for username enumeration via authentication responses.

hydra -L users.txt -p invalid target http-post-form

Enumerate OAuth / SSO endpoints and providers.

curl https://target/.well-known/openid-configuration

Service Enumeration

Enumerate SMTP capabilities and authentication methods.

nmap -p 25,465,587 --script smtp-enum-users <target>

Enumerate SSH configuration and auth methods.

nmap -p 22 --script ssh-auth-methods,ssh2-enum-algos <target>

Enumerate RDP configuration and security level.

nmap -p 3389 --script rdp-enum-encryption,rdp-ntlm-info <target>

Cloud Enumeration

Enumerate Azure blob containers.

az storage container list --account-name target

Enumerate exposed Google Cloud storage buckets.

gsutil ls gs://bucket-name

Enumerate public cloud storage permissions.

aws s3 ls s3://bucket-name

#Internal Focused Enumeration

SMB Enumeration (Windows Focused)

Enumerate SMB users, shares, policies, and OS information.

enum4linux -a <target>

List available SMB shares without authentication.

smbclient -L //target -N

Enumerate SMB targets for users, shares, and permissions.

crackmapexec smb <target>

Enumerate SMB shares across a subnet.

crackmapexec smb 10.0.0.0/24 --shares

LDAP / Active Directory Enumeration

Enumerate domain information anonymously if permitted.

ldapsearch -x -h <target>

Enumerate domain users, groups, and policies via LDAP.

crackmapexec ldap <target>

Collect comprehensive AD relationship data for graph analysis.

bloodhound-python -d domain.local -u user -p pass -c All

Enumerate domain users with valid credentials.

crackmapexec smb target -u user -p pass --users

RPC Enumeration

Start an RPC client session (anonymous if permitted).

rpcclient -U "" target

List domain users through RPC calls (run inside rpcclient).

enumdomusers

List domain groups (inside rpcclient)

enumdomgroups

Local Enumeration (Linux)

Identify kernel and OS version information.

uname -a

Display current user identity and group memberships.

id

List sudo privileges available to the current user.

sudo -l

Identify running processes and services.

ps aux

List listening services and open ports.

ss -lntup

Identify SUID binaries

find / -perm -4000 2>/dev/null

List system-wide cron jobs

ls -la /etc/cron*

Search for credentials in configuration files

# Searches for the term password.
grep -Ri "password" /etc 2>/dev/null

Local Enumeration Windows

Display detailed user, group, and privilege information.

whoami /all

Enumerate local user accounts.
CMD:

net user

PowerShell:

Get-LocalUser | Select Name,Enabled,LastLogon

List members of the local administrators group.
CMD:

net localgroup administrators

PowerShell:

Get-LocalGroupMember -Group "Administrators"

Enumerate domain users.
CMD:

net user /domain

PowerShell:

Get-ADUser -Filter *

Display system information including patch level.

systeminfo

Enumerate scheduled tasks.
CMD:

schtasks /query /fo LIST /v

PowerShell:

# Identifies scheduled tasks running with elevatied Privs
Get-ScheduledTask | Where-Object { $_.Principal.RunLevel -eq "Highest" }

Enumerate Services for path misconfiguration

wmic service get name,displayname,pathname,startmode |findstr /i "auto" |findstr /i /v "c:\windows\\" |findstr /i /v """

#Notes

Notes

Enumeration assumes intent and often credentials.
Expect higher signal and higher detection than recon.
This phase feeds directly into exploitation and lateral movement.

#External Focused Enumeration

Web Enumeration

Enumerate directories and files exposed by a web application.

gobuster dir -u https://target -w wordlist.txt

Fuzz URL paths to identify hidden endpoints and parameters.

ffuf -u https://target/FUZZ -w wordlist.txt

Enumerate HTTP methods supported by a web server.

curl -X OPTIONS https://target

Identify application routes and behaviors by inspecting responses.

curl -s https://target | less

Enumerate API routes and versions.

ffuf -u https://api.target/FUZZ -w api.txt

Enumerate GraphQL schema via introspection.

curl -X POST https://target/graphql -d '{"query":"{__schema{types{name}}}"}'

Authentication Enumeration

Enumerate exposed login endpoints and auth flows.

ffuf -u https://target/FUZZ -w auth.txt

Test for username enumeration via authentication responses.

hydra -L users.txt -p invalid target http-post-form

Enumerate OAuth / SSO endpoints and providers.

curl https://target/.well-known/openid-configuration

Service Enumeration

Enumerate SMTP capabilities and authentication methods.

nmap -p 25,465,587 --script smtp-enum-users <target>

Enumerate SSH configuration and auth methods.

nmap -p 22 --script ssh-auth-methods,ssh2-enum-algos <target>

Enumerate RDP configuration and security level.

nmap -p 3389 --script rdp-enum-encryption,rdp-ntlm-info <target>

Cloud Enumeration

Enumerate Azure blob containers.

az storage container list --account-name target

Enumerate exposed Google Cloud storage buckets.

gsutil ls gs://bucket-name

Enumerate public cloud storage permissions.

aws s3 ls s3://bucket-name

#Internal Focused Enumeration

SMB Enumeration (Windows Focused)

Enumerate SMB users, shares, policies, and OS information.

enum4linux -a <target>

List available SMB shares without authentication.

smbclient -L //target -N

Enumerate SMB targets for users, shares, and permissions.

crackmapexec smb <target>

Enumerate SMB shares across a subnet.

crackmapexec smb 10.0.0.0/24 --shares

LDAP / Active Directory Enumeration

Enumerate domain information anonymously if permitted.

ldapsearch -x -h <target>

Enumerate domain users, groups, and policies via LDAP.

crackmapexec ldap <target>

Collect comprehensive AD relationship data for graph analysis.

bloodhound-python -d domain.local -u user -p pass -c All

Enumerate domain users with valid credentials.

crackmapexec smb target -u user -p pass --users

RPC Enumeration

Start an RPC client session (anonymous if permitted).

rpcclient -U "" target

List domain users through RPC calls (run inside rpcclient).

enumdomusers

List domain groups (inside rpcclient)

enumdomgroups

Local Enumeration (Linux)

Identify kernel and OS version information.

uname -a

Display current user identity and group memberships.

id

List sudo privileges available to the current user.

sudo -l

Identify running processes and services.

ps aux

List listening services and open ports.

ss -lntup

Identify SUID binaries

find / -perm -4000 2>/dev/null

List system-wide cron jobs

ls -la /etc/cron*

Search for credentials in configuration files

# Searches for the term password.
grep -Ri "password" /etc 2>/dev/null

Local Enumeration Windows

Display detailed user, group, and privilege information.

whoami /all

Enumerate local user accounts.
CMD:

net user

PowerShell:

Get-LocalUser | Select Name,Enabled,LastLogon

List members of the local administrators group.
CMD:

net localgroup administrators

PowerShell:

Get-LocalGroupMember -Group "Administrators"

Enumerate domain users.
CMD:

net user /domain

PowerShell:

Get-ADUser -Filter *

Display system information including patch level.

systeminfo

Enumerate scheduled tasks.
CMD:

schtasks /query /fo LIST /v

PowerShell:

# Identifies scheduled tasks running with elevatied Privs
Get-ScheduledTask | Where-Object { $_.Principal.RunLevel -eq "Highest" }

Enumerate Services for path misconfiguration

wmic service get name,displayname,pathname,startmode |findstr /i "auto" |findstr /i /v "c:\windows\\" |findstr /i /v """

Enumeration and Discovery cheatsheet

#External Focused Enumeration

#Internal Focused Enumeration

#Notes

Bash

Code Execution

Credential Access

Sandbox Detection/Evasion (Windows)

Shellcode Runners

Metasploit

The Briefing Room

EC Github

Playbook Github

Enumeration and Discovery cheatsheet

#External Focused Enumeration

#Internal Focused Enumeration

#Notes

Bash

Code Execution

Credential Access

Sandbox Detection/Evasion (Windows)

Shellcode Runners

Metasploit

The Briefing Room

EC Github

Playbook Github