Kali Linux Command Cheat Sheet
The ultimate reference guide for penetration testing tools and commands
Table of Contents
- 1. Introduction & Basics
- 2. System Commands
- 3. Network Commands
- 4. Information Gathering
- 5. Vulnerability Scanning
- 6. Exploitation Tools
- 7. Web App Tools
- 8. Password Attacks
- 9. Wireless Attacks
- 10. Sniffing & Spoofing
- 11. Post Exploitation
- 12. Digital Forensics
- 13. Reporting Tools
- 14. Social Engineering
- 15. Anonymity Tools
- 16. Bash Scripting
1. Introduction to Kali Linux
Essential commands for checking system status and managing packages.
Basic System Information
uname -a
Display system information including kernel version
cat /etc/os-release
Show Kali Linux version information
df -h
Check disk space usage
free -m
Display memory usage
Package Management
sudo apt update && sudo apt upgrade
Update package lists and upgrade packages
sudo apt install package_name
Install a new package
sudo apt remove package_name
Remove a package
sudo apt list –installed | grep keyword
Search for installed packages
2. System Commands
File System Navigation
ls -la
List all files with details
find / -name filename 2>/dev/null
Find files by name, hiding error messages
locate filename
Quickly locate files using database
updatedb
Update the locate database
User Management
sudo useradd -m username
Create a new user with home directory
sudo passwd username
Set or change password for a user
sudo usermod -aG sudo username
Add user to sudo group
id
Display current user ID and groups
Process Management
ps aux
Display all running processes
kill PID
Kill a process by its PID
killall process_name
Kill all processes with the given name
top
Display and manage running processes
3. Network Commands & Utilities
Network Configuration
ifconfig
Display network interfaces (Legacy)
ip a
Display network info (Modern)
iwconfig
Display wireless network interfaces
route -n
Display routing table
Troubleshooting
ping target
Test connectivity to a host
traceroute target
Trace route to a host
netstat -tuln
Show listening ports and established connections
4. Information Gathering
DNS Reconnaissance
host domain.com
Perform DNS lookup
dig domain.com any
Detailed DNS lookup
dnsenum domain.com
Enumerate DNS information
dnsrecon -d domain.com
DNS reconnaissance tool
Subdomain & WHOIS
sublist3r -d domain.com
Fast subdomain enumeration tool
whois domain.com
Query WHOIS information
theHarvester -d domain.com -b all
Gather emails, subdomains, hosts
recon-ng
Full-featured reconnaissance framework
5. Vulnerability Scanning
Port Scanning with Nmap
nmap -sS target
SYN scan (default, stealthy)
nmap -sV -sC target
Service version detection + default scripts
nmap -p- target
Scan all 65535 ports
nmap -A target
Aggressive scan (OS, versions, scripts)
nmap –script vuln target
Scan for vulnerabilities
masscan -p1-65535 target –rate=1000
Ultra-fast port scanner
Vuln Scanners
nikto -h target
Web server scanner
searchsploit keyword
Search Exploit-DB
6. Exploitation Tools
Metasploit Framework
msfconsole
Start Metasploit console
search exploit_name
Search for exploits (inside MSF)
use exploit_path
Select an exploit to use
show options
Display options
exploit
Run the selected exploit
7. Web Application Tools
wpscan –url http://example.com –enumerate u
WordPress vulnerability scanner
dirb url wordlist
Web directory brute force
gobuster dir -u url -w wordlist
Fast directory brute force
sqlmap -u http://site.com/p?id=1
Automated SQL injection
burpsuite
Start Burp Suite (Web Proxy)
8. Password Attacks
john –wordlist=list.txt hashfile
John the Ripper password cracker
hashcat -m 0 -a 0 hash list
Hashcat advanced recovery
hydra -l user -P list.txt ftp://ip
Online service brute force (Hydra)
crunch min max chars -o file
Generate custom wordlists
9. Wireless Attacks
airodump-ng interface
Capture wireless packets
aireplay-ng –deauth 10 -a bssid interface
Deauthentication attack
wifite
Automated wireless auditor
kismet
Wireless network detector
10. Sniffing & Spoofing
tcpdump -i interface
Capture network traffic (CLI)
wireshark
GUI Packet Analyzer
ettercap -G
Man-in-the-middle attacks (GUI)
arpspoof -i iface -t target gateway
ARP Spoofing tool
bettercap
The Swiss Army knife for network attacks
11. Post Exploitation
sudo -l
List sudo privileges
linpeas.sh
Auto privilege escalation script
find / -perm -u=s 2>/dev/null
Find SUID files
crontab -e
Edit cron jobs (Persistence)
12. Digital Forensics
strings file
Extract text strings from binary
binwalk file
Analyze firmware images
foremost -i file
File carving/recovery
volatility -f dump imageinfo
Memory forensics framework
13. Reporting Tools
faraday
Collaborative pentest platform
dradis
Reporting and collaboration
15. Anonymity Tools
service tor start
Start Tor service
proxychains command
Run command via Proxychains
macchanger -r interface
Randomize MAC address
16. Bash Scripting
#!/bin/bash
Shebang line
echo “Text”
Print text to screen
read var
Take user input
if [ cond ]; then…
Basic If statement