Suggestion: Add packet capture to the cheat sheet.

[unixtreme]

While Nmap is handy a packet capture can help find software being used, protocols, and often their versions. All of which can help find vulnerable targets.

e.g. a quick packet capture could show you servers using SMB1.0 which doesn't support encryption, allowing you to capture information over the wire.