Run this every time you connect to a new target network. Takes 5 minutes and saves hours.
Step 1: Confirm VPN is up and note your attack IP
ip a show tun0 # or eth0/tap0 depending on platform
export MYIP=$(ip -4 addr show tun0 | grep -oP '(?<=inet\s)\d+(\.\d+){3}')echo "Attack IP: $MYIP"
Step 2: Set target IP variable
export TARGET=<TARGET-IP>
echo "Target: $TARGET"
Step 3: Create organized engagement folder
mkdir -p ~/engagements/$TARGET/{scans,loot,exploits,screenshots,notes}cd ~/engagements/$TARGET
touch notes/notes.md
Step 4: Start your note file
cat >> notes/notes.md << EOF
Target: $TARGET
# Date: $(date)
# Attack IP: $MYIP
---
EOF
Step 5: Kick off background scan immediately · don't wait
nmap -p- --min-rate 5000 -T4 $TARGET -oA scans/full_tcp &
Step 6: Quick scan first while full scan runs
nmap -sC -sV -p 21,22,25,53,80,110,111,135,139,143,443,445,3306,3389,5985,8080,8443 $TARGET -oA scans/quick_common
Step 7: While scans run, check for web presence
curl -I http://$TARGET 2>/dev/null | head -20
curl -I https://$TARGET 2>/dev/null | head -20
Checklist
- [ ]VPN connected, tun0 IP confirmed
- [ ]TARGET variable set
- [ ]Engagement folder created
- [ ]Background full TCP scan running
- [ ]Notes file open and timestamped
- [ ]Listening on standard ports ready (nc -lvnp 4444 in separate tmux pane)