Appendix A. Reference (Cheat Sheet) 📑¶

A collection of quick-reference tables for the commands, options, and information sources you'll use most. For a detailed explanation of each item, follow the link to the relevant chapter in the main text.

Key nmap options¶

Option	Meaning	sudo
`-sn 範囲`	Host discovery (who's alive?)
`-sT`	TCP connect scan (no privileges needed; easily logged)
`-sS`	SYN stealth scan ⭐most common	✓
`-sU`	UDP scan (DNS/SNMP, etc.)
`-sV`	Service/version detection
`-O`	OS detection	✓
`-A`	The works (OS + version + scripts + traceroute) ⭐	✓
`-p 範囲` / `-F`	Specify ports / fast (top ports only)
`--script 名`	NSE scripts (`--script vuln` for vulnerability checks)
`-T0〜T5`	Speed (0 = ultra-cautious … 5 = blazing fast; T4 is practical)
`-oN/-oX/-oA`	Save results (normal/XML/all formats) ※contains real IPs, so keep private

→ Detailed usage: 06. Recon — nmap

Other tools for identifying the tech stack¶

Tool	How to use
`whatweb http://...`	Hit a URL and identify its technologies instantly
Wappalyzer	Browser extension; just open the page to detect
`curl -I http://...`	Inspect response headers (Server/Cookie)

Basic Metasploit commands¶

Command	What it does
`search <語>`	Find usable exploit code
`use <module>`	Select an exploit
`set <項目> <値>`	Configure the target/payload
`show options`	Review the settings
`show payloads`	List usable payloads
`check`	Safely confirm whether it will land
`exploit`	Run the exploit
`sessions -l` / `sessions -i N`	List sessions / enter session N

→ Detailed usage: 07. Exploitation — Metasploit

Key meterpreter commands¶

Command	What it does
`getuid`	Who you're running as
`sysinfo`	The target's OS and architecture
`pwd` / `cd` / `ls`	Current location / move / list
`cat ファイル`	Show a file's contents
`download` / `upload`	Retrieve / send files
`shell`	Drop into a normal Linux shell (`exit` to leave)
`ps`	List processes
`background`	Send the session to the background
`help`	List commands

→ Detailed usage: 08. Post-exploitation — meterpreter

Go-to sites for researching vulnerabilities¶

Site	What you learn
CVE (cve.org)	The official ID for a vulnerability (e.g., CVE-2017-5638)
NVD (nvd.nist.gov)	Severity score (CVSS)
Exploit-DB (exploit-db.com)	Actual exploit code
Rapid7 DB (rapid7.com/db)	Metasploit module coverage

→ How to use: 07. Exploitation — Metasploit

Practice targets (startup commands)¶

Target	Start	URL
Struts2 S2-045	`docker run -d --name struts2-s2045 -p 127.0.0.1:8088:8080 vulhub/struts2:2.3.30`	localhost:8088
Juice Shop	`docker run -d --name juice-shop -p 127.0.0.1:3000:3000 bkimminich/juice-shop`	localhost:3000

→ Details: 05. Standing up practice targets

⚠️ Use everything here only against your own property or targets you're authorized to test.