Kali Linux Commands Cheat Sheet 2026 — 150 Tools, 2955 Commands, One Click

The Kali Linux Commands cheat sheet at securityelites.com/tools/kali-linux-commands/ sits alongside the 180-Day Kali Linux Mastery Course as a reference layer — the course teaches you how and why each tool works, the cheat sheet gives you instant command recall during the sessions where you actually need it. Both are free, both work together, and you need both.

What the SecurityElites Kali Linux Commands Cheat Sheet Actually Contains

Most “Kali Linux cheat sheets” that appear in Google results contain 15 to 30 tools and were written in 2020. They cover Nmap, Metasploit, Hydra, and a handful of other tools that every beginner already knows. They miss the 120 tools that professional penetration testers actually use for the full engagement lifecycle — the ones where you spend 10 minutes searching for the right flag syntax because nobody covers them.

The SecurityElites Kali Linux Commands reference was built differently. It starts from the complete Kali Linux toolset and selects the 150 tools that appear most frequently in real penetration testing engagements, bug bounty workflows, OSCP lab work, and CTF competitions. For each tool, it contains every command variant a professional would actually use — not just the introductory one-liner, but the full range from basic discovery through advanced flag combinations used in real assessments.

Interface Walkthrough — Categories, Filters and One-Click Copy

The tool loads at securityelites.com/tools/kali-linux-commands/ with zero page load overhead — no account, no cookie consent wall, no email gate. The interface has three zones: the category filter bar at the top, the tool list on the left, and the command display panel on the right.

The category filter bar contains 14 pills: All (150 tools) plus the 13 category names. Clicking a category pill immediately filters the tool list on the left to only show tools in that category. The tool count updates in real time — clicking Recon shows 22 tools, Web App shows 27. This is the fastest way to navigate when you know the category but not the specific tool name.

The tool list on the left is a scrollable panel of tool names. Clicking any tool name loads all commands for that tool in the main display panel. The display panel shows each command on its own row with a description of what it does and a Copy button aligned to the right. Clicking Copy copies the complete command string to your clipboard with the correct syntax, flags, and spacing preserved exactly as written — no PDF rendering artefacts, no line break corruption.

Recon and Web App Categories — The 49 Tools You Use Most

The Recon category is where every engagement starts. Twenty-two tools covering the full reconnaissance spectrum — from initial host discovery with Netdiscover and Nmap through subdomain enumeration with Amass and Subfinder, DNS intelligence with DNSrecon and dnsx, web content discovery with httpx and EyeWitness, and automated vulnerability detection with Nuclei. For a category that contains the foundation of every assessment, having all 22 tools with their full command sets in one panel eliminates the context switching that breaks focus during recon phases.

The most commonly referenced commands in the Recon category during professional assessments are the Nmap combination flags. The classic service scan — nmap -sV -sC -p- --open TARGET — appears in every pentest report preamble, but the tool contains the full range beyond the basics: NSE script categories, timing templates, output formats for all four file types, and the specific flag combinations for OSCP-style enumeration methodology. If you have ever spent 90 seconds trying to remember whether it is -oA or -oN for saving output, those 90 seconds are gone with one click.

The Web App category is the largest at 27 tools — reflecting the reality that web application testing now constitutes the majority of both bug bounty work and external penetration testing engagements. Burp Suite commands cover proxy configuration, Intruder attack types, and the Turbo Intruder integration that Day 16 of the Bug Bounty course covered. SQLMap commands span the full injection methodology from detection flags through database enumeration and data dumping with WAF bypass tamper scripts included. The directory busting trio — Gobuster, ffuf, and Feroxbuster — each have multiple command variants covering different wordlist strategies, extension filtering, and output formats.

Exploitation, Password and Wireless — Attack Phase Commands

The Exploitation category covers 11 tools and represents the phase most learners focus on first but actually use least in professional assessments — because most real-world engagements do not reach the point of running Metasploit exploits. Understanding the exploitation tools in context means knowing when to use them versus manual exploitation approaches. The cheat sheet includes full Metasploit module workflow commands, msfvenom payload generation for all major platforms including PHP, ASP, Python, PowerShell, and ELF, and searchsploit query syntax for finding applicable exploits from the offline ExploitDB database during network-restricted engagements like OSCP.

The Password category is where the cheat sheet saves the most time during actual testing. Hydra’s flag syntax — particularly the service-specific format differences between HTTP form attacks, SSH, FTP, and SMB — is genuinely difficult to remember without reference. The difference between http-post-form and http-form-post, the exact format of the colon-separated field string, and the success/failure string syntax are all present in the tool with working examples. Hashcat mode numbers are similarly reference-heavy: mode 0 for MD5, 100 for SHA1, 1000 for NTLM, 1800 for SHA-512crypt, 13100 for Kerberoast — the tool lists all major hash modes with their corresponding numbers.

Post-Exploitation, Active Directory and OSINT — Advanced Phases

The Post-Exploitation and Active Directory categories are where the cheat sheet most significantly outperforms every other free command reference. There is almost no comprehensive free resource that covers Impacket’s full suite — psexec, wmiexec, smbexec, secretsdump, GetNPUsers, GetUserSPNs — with working command syntax and the correct credential format variations for hash-only attacks. The SecurityElites cheat sheet covers all of them across the Post-Exploitation and Active Directory categories, making it the go-to reference during the AD attack phases covered in Days 23–50 of the Ethical Hacking course.

BloodHound’s Python-based data collection commands, the Cypher query syntax for finding attack paths, and the command-line flags for CrackMapExec’s various execution modes are all present. Rubeus commands for Kerberoasting, AS-REP roasting, and ticket manipulation round out the Kerberos attack coverage. For OSCP students doing the Active Directory sets, having every Impacket and CrackMapExec command available in one browser tab is a significant time saver during timed exam conditions.

The OSINT category covers 13 tools including Maltego, Shodan CLI, SpiderFoot, Recon-ng, theHarvester, Amass OSINT mode, and the crt.sh curl commands that pull certificate transparency data without a web interface. The sniffing category covers Wireshark display filter syntax — one of the most referenced but least memorisable command sets in all of Kali — alongside tcpdump capture filters, Responder configuration, and Bettercap network manipulation commands.

How to Integrate the Cheat Sheet Into OSCP, CTF and Real Engagements

The cheat sheet is not a learning tool — it is a recall tool. The difference matters for how you use it. You should not be reading the cheat sheet to understand what a tool does. You should be opening it when you know exactly what you need but cannot remember the precise syntax. The workflow for each scenario type is different.

For OSCP lab work: Keep the cheat sheet open in a dedicated browser tab throughout every lab session. The OSCP exam’s 23-hour time pressure punishes the 90-second searches for flag syntax. Before each tool you intend to use, spend 30 seconds reviewing its commands in the cheat sheet — this primes your memory and ensures you are using the most appropriate flags for your specific objective. The Active Directory and Post-Exploitation categories are especially valuable during the AD set machines where you cycle through multiple Impacket tools in sequence.

For CTF competitions: CTFs introduce novel challenges but always use standard tools. The cheat sheet’s 13-category structure matches the CTF challenge categories — web exploitation aligns with Web App, crypto challenges align with the Crypto category, forensics challenges align with Volatility and Autopsy commands in the Forensics category. During timed CTF events, having the copy functionality means you can run commands from the reference without retyping — reducing typo-related wasted time.

For bug bounty recon: The Recon and OSINT categories together give you the complete automated recon pipeline. The cheat sheet contains the exact Subfinder, httpx, Nuclei, and gau command chains that feed into a professional bug bounty recon workflow. Copy the commands in sequence, substitute your target domain, and run them in parallel terminal windows without stopping to look up any syntax.

For professional engagements: The most valuable professional use of the cheat sheet is pre-engagement preparation. Before connecting to a client network, spend 15 minutes reviewing the categories relevant to the scope — if it is an AD engagement, review the Active Directory and Post-Exploitation categories and have the key commands bookmarked. This replaces the “notebook of notes” that experienced testers carry — and unlike a handwritten notebook, the one-click copy means zero transcription errors when running commands against live infrastructure.