The starter toolkit

4 min read

You do not need much to start, and reaching for a big framework early usually hurts. The core:

• nmap — nmap -p- -sV for a full port + version sweep; the foundation of enumeration.
• A web content scanner (ffuf, gobuster) — directories and vhosts are where web footholds hide.
• A shell catcher — nc -lvnp to receive a reverse shell, plus the TTY upgrade dance (python3 -c 'pty.spawn…', then stty).
• A privesc enumerator — LinPEAS or a manual pass: sudo -l, find / -perm -4000, crontab, world-writable files.
• GTFOBins — the lookup for "this binary I can run as root, how does it give me a shell". Half of Linux privesc is a GTFOBins entry away.

The through-line: enumerate, get a foothold, enumerate again, escalate. Same rhythm on every box.