Network Recon Toolbox — local quick reference

Verified installed & working on this Windows machine (Oct 16, 2026).

Tool	Version	Location / how to run	Verified
nmap	(PATH)	nmap -sn 192.168.137.1-60 — found 15 live hosts on LAN	✅
tshark (Wireshark 4.6.9)	4.6.9	C:\Program Files\Wireshark\tshark.exe (installed via winget this session; Npcap service RUNNING)	✅ captured 200 pkts loopback
sherlock	0.16.2	%USERPROFILE%\.local\bin (uv tool)	✅ sherlock --print-found elonmusk
mitmproxy/mitmdump	(uv tool)	mitmdump -q --listen-port 8099 — currently running (PID on :8099)	✅ proxy test 200 via 127.0.0.1:8099
sqlmap	1.10.10	%USERPROFILE%\.local\bin (pip)	✅

Quirks discovered (Windows)

• sqlmap prints Press Enter to continue... on startup — pipe a newline: echo | sqlmap --version.
• sherlock has no -t flag; usernames are positional: sherlock --print-found <user>. uv tool install sherlock fails (no entry points); it works via the pip-installed copy in .local/bin.
• winget id is WiresharkFoundation.Wireshark (no space).
• tshark interfaces: tshark -D → 2=Wi-Fi, 4=Ethernet, 5=Npcap Loopback.
• mitmproxy CA already generated at ~/.mitmproxy/ (ca.pem, ca.p12, ca-cert.cer).

One-liners

# LAN sweep
nmap -sn 192.168.137.1-254

# 5s packet-capture protocol summary on Wi-Fi
tshark -i 2 -a duration:5 -q -z io,phs

# username OSINT
sherlock --print-found --no-color <username>

# intercept traffic (mitmdump already listening on 8099)
curl -x http://127.0.0.1:8099 http://example.com

# SQLi scan
echo | sqlmap -u "http://target/page?id=1" --batch --level 2

AirCrack — Wi-Fi handshake capture (not installed on Windows)

Linux + monitor-mode Wi-Fi adapter. Captures the WPA handshake and recovers the password by dictionary/brute force. The catch: only beats weak/old passwords; WPA3 + long random password = uncrackable. Aiming it at a neighbor's network = potential federal charges.

Self-defense summary (from the video)

Thesis: everything you do online is visible to one person with a laptop, and nothing you see online can be trusted anymore.

• Username reuse leaks your whole profile (Sherlock).
• Never install device profiles/certificates you didn't ask for (MITM).
• Long random Wi-Fi passwords + WPA3 (AirCrack).
• Assume anything unencrypted is public (Wireshark/tshark).
• Parameterize SQL; nothing client-side is trustworthy (SQLMap).