Cyco-Jack 👤

🗺️ Nmap — Network Scanner

Nmap (Network Mapper) is the most powerful free tool for network scanning, port discovery, and service enumeration used by pentesters worldwide.

📦 Installation

⚡ Essential Commands

• nmap 192.168.1.1 — Scan single IP
• nmap -sV 192.168.1.1 — Detect service versions
• nmap -sS -O 192.168.1.1 — Stealth scan + OS detection
• nmap -A -T4 192.168.1.0/24 — Aggressive full network scan
• nmap -p 1-65535 192.168.1.1 — Scan all ports
• nmap --script vuln 192.168.1.1 — Scan for known vulnerabilities
• nmap -sU -p 53,67,161 192.168.1.1 — UDP scan
• nmap -oN output.txt 192.168.1.1 — Save results to file

💡 Pro Tips

• Use -T4 for fast scanning and -T1 for slow stealthy scan.
• NSE (Nmap Scripting Engine) offers 600+ ready scripts.
• --script http-title to grab web page titles on the network.

🕷️ Burp Suite — Web Proxy & Vulnerability Scanner

Burp Suite is the gold standard for web application security testing. The free Community edition allows intercepting, modifying, and replaying HTTP requests.

📦 Installation

Download Community Edition from: portswigger.net/burp/communitydownload

⚡ Core Modules

• 🔵 Proxy — Intercept & modify requests between browser and server
• 🟢 Repeater — Manually replay & modify individual requests
• 🟡 Intruder — Automated attacks on parameters & forms
• 🔴 Scanner — (Pro only) Automated vulnerability scanning
• 🟣 Decoder — Encode/decode data (Base64, URL, HTML)
• ⚪ Comparer — Compare responses to spot differences

🛠️ How to Use

1. Launch Burp Suite and open Proxy → Intercept.
2. Configure your browser to use proxy: 127.0.0.1:8080.
3. Browse the target site — requests flow through Burp.
4. Send requests to Repeater to modify and replay.
5. Use Intruder to test password lists and parameter fuzzing.

🔗 Maltego — OSINT & Digital Investigation

Maltego is a leading OSINT tool for gathering intelligence and analyzing relationships between entities (people, companies, domains, IPs) with visual graph representation.

📦 Installation

Download from official site and register a free account: maltego.com

⚡ Entity Types

• 🌐 Domain — Discover subdomains, DNS records, MX
• 👤 Person — Find personal info and social accounts
• 📧 Email — Link email to sites and profiles
• 🖥️ IP Address — Trace locations and organizations linked to an IP
• 🏢 Organization — Map a company and its employees

🛠️ Workflow

1. Open Maltego and create a new Graph.
2. Drag an entity (e.g. Domain) to the workspace.
3. Right-click → Run Transforms.
4. The graph expands automatically discovering new connections.
5. Use Machines to automate transform chains.

🌾 TheHarvester — Email & Domain Harvester

TheHarvester is a powerful OSINT tool for gathering emails, usernames, subdomains, and IPs from public sources like Google, Bing, Shodan, and LinkedIn.

📦 Installation

⚡ Essential Commands

• theHarvester -d example.com -b google — Harvest via Google
• theHarvester -d example.com -b all — Harvest from all sources
• theHarvester -d example.com -b linkedin — Harvest company employees from LinkedIn
• theHarvester -d example.com -b shodan — Query Shodan database
• theHarvester -d example.com -b google -f report.html — Save report as HTML
• theHarvester -d example.com -l 500 -b bing — Harvest up to 500 results

💡 Data Sources

google, bing, baidu, duckduckgo, yahoo, linkedin, twitter, shodan, hunter, anubis, otx, threatminer and 20+ more sources.

🌐 Shodan — IoT & Infrastructure Search Engine

Shodan is the most powerful search engine for discovering internet-connected devices: cameras, routers, servers, SCADA systems, and more.

📦 Installation (CLI)

🔍 Important Search Filters

• country:SA port:22 — Open SSH in Saudi Arabia
• org:"Saudi Telecom" port:80 — Web servers at STC
• webcam has_screenshot:true — Exposed webcams with screenshots
• default password — Devices with default password
• product:nginx version:1.14 — Specific Nginx version

⚡ CLI Commands

• shodan search "apache" --limit 100
• shodan host 8.8.8.8 — Info about specific IP
• shodan count "port:3389 country:SA" — Count results
• shodan domain example.com — Domain intelligence

🔑 Hashcat — World's Fastest Password Cracker

Hashcat is the world's fastest password recovery utility supporting 300+ hash types, leveraging GPU power for maximum cracking speed.

📦 Installation

📋 Common Hash Types (-m)

• 🔵 -m 0 → MD5  |  -m 100 → SHA1  |  -m 1400 → SHA256
• 🟢 -m 1800 → SHA512crypt (Linux)  |  -m 3200 → bcrypt
• 🟡 -m 22000 → WPA-PBKDF2 (WiFi)  |  -m 2500 → WPA/WPA2
• 🔴 -m 13100 → Kerberoast  |  -m 5500 → NetNTLMv1

⚡ Essential Commands

• hashcat -m 0 hash.txt rockyou.txt — Dictionary attack on MD5
• hashcat -m 0 -a 3 hash.txt ?a?a?a?a?a?a — Brute force 6 chars
• hashcat -m 22000 wifi.hc22000 rockyou.txt — Crack WiFi password
• hashcat -m 0 hash.txt rockyou.txt -r rules/best64.rule — Rule-based attack
• hashcat --show -m 0 hash.txt — Show cracked passwords

💡 Brute Force Charset Masks

?l = lowercase | ?u = uppercase | ?d = digits | ?s = symbols | ?a = all

🪓 John the Ripper — Classic Password Cracker

John the Ripper (JtR) is a classic password cracker that auto-detects hash types and supports dictionary, brute-force, and rule-based attacks.

📦 Installation

⚡ Essential Commands

• john hash.txt — Auto-crack with hash auto-detection
• john --wordlist=rockyou.txt hash.txt — Dictionary attack
• john --format=raw-md5 hash.txt — Specify hash type manually
• john --show hash.txt — Show cracked passwords
• unshadow /etc/passwd /etc/shadow > combined.txt — Combine Linux password files
• john combined.txt --wordlist=rockyou.txt — Crack Linux passwords
• zip2john file.zip > zip_hash.txt && john zip_hash.txt — Crack ZIP password
• pdf2john file.pdf > pdf_hash.txt && john pdf_hash.txt — Crack PDF password

🔒 GnuPG (GPG) — Encryption & Digital Signatures

GnuPG is a free encryption tool for encrypting files, messages, and creating digital signatures to secure communications and verify sender identity.

📦 Installation

⚡ Essential Commands

• gpg --gen-key — Generate new key pair
• gpg --list-keys — List stored keys
• gpg -e -r "[email protected]" file.txt — Encrypt a file
• gpg -d file.txt.gpg — Decrypt a file
• gpg --sign file.txt — Digitally sign a file
• gpg --verify file.txt.sig — Verify a signature
• gpg --export -a "Your Name" > public.key — Export public key
• gpg --import public.key — Import public key

📡 Wifite — Automated WiFi Cracker

Wifite is an automated WiFi auditing tool for WEP/WPA/WPA2/WPS networks, combining Aircrack-ng, Reaver, and Hashcat automatically.

📦 Installation

⚡ Essential Commands

• sudo wifite — Start with auto-detection
• sudo wifite --wps — Focus on WPS attacks
• sudo wifite --dict /usr/share/wordlists/rockyou.txt
• sudo wifite --kill — Kill conflicting processes
• sudo wifite --mac — Randomize MAC address
• sudo wifite --pixie — Fast Pixie-Dust attack