57 entries tagged “Linux”. Browse all tags
The scp and sftp quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real transfer. Upload and download, copy a directory with -r, authenticate with a recovered key, hop through a jump host, pipe over ssh when scp is missing, and verify with a checksum.
The netcat file-transfer quick reference: flags, a modular cheat sheet, and worked breakdowns. Listen and save, connect and send, close cleanly with -N or -q0, stream a directory with tar, encrypt with socat OPENSSL, fall back to bash /dev/tcp when nc is missing, and checksum to catch truncation.
The HTTP file-transfer quick reference: serve a folder from your attacker box in one line, then pull files onto the target with wget, curl, certutil, PowerShell, or curl.exe. Flags, a modular cheat sheet, in-memory execution, upload-back with updog, checksum verification, and beating egress filters by serving on 80 or 443.
The file-transfer quick reference: the serve-and-pull vs push-and-receive decision, a modular copy-paste cheat sheet, and a worked breakdown of every method. Serve a folder over HTTP, pull with wget or certutil, host an SMB share, move a file with netcat or socat, copy over scp, paste a base64 blob, and checksum both ends.
The base64 file-transfer quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Encode a file to one pasteable line, decode it with a heredoc, move files with certutil or PowerShell on Windows, chunk a blob too long to paste, and checksum both ends to prove it arrived intact.
A practical NetExec guide: install it, verify it, enumerate one protocol at a time, validate credentials without locking accounts, read the output honestly, and keep a cheat sheet you will actually reuse.
The socat quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Verbose TCP client, port forward, UNIX-socket-to-TCP bridge, TLS wrap, hex-dump a protocol, upgrade a reverse shell to a full PTY, and a virtual serial pair.
The whois quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Look up a domain, find who owns an IP, enumerate a netblock, pull name servers, read registration dates, query a registry directly, and route around a redacted or wrong-server answer with RDAP.
The wget quick reference: install and verify, a modular copy-paste cheat sheet, and one command for every real situation. Resume a broken download, mirror a site for offline viewing, pull a list of URLs, reuse a login cookie, POST a form, and rate-limit to stay quiet.
The TShark quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Read a PCAP, filter by BPF or display syntax, extract clean fields, follow a TCP stream, pull cleartext creds, carve files out of HTTP, and spot a port scan.
The enum4linux-ng quick reference: the flags that matter, a modular copy-paste cheat sheet, and a worked breakdown of every real SMB and RPC situation. List shares anonymously, enumerate users and groups, dump the password policy, RID-cycle when direct enum is blocked, add credentials for depth, and export clean JSON or YAML.
The sqlmap quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Confirm an injectable parameter, feed a saved Burp request, fingerprint the DBMS, walk the dbs/tables/columns ladder, dump only the columns you need, grab password hashes, evade a WAF with tamper scripts, and route through a proxy.
The Nikto quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real scan. Scan HTTP and HTTPS, hit odd ports, reach a vhost by Host header, tune out the noise, proxy through Burp, save a machine-readable report, and pull just the findings.
The dirsearch quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real content-discovery task. Pick a wordlist, append extensions, filter soft-404s by size, recurse into found directories, scan a list of hosts, save JSON, and proxy through Burp.
The dig quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Resolve A/AAAA, find MX and NS, read SPF and DMARC TXT, reverse-lookup an IP, query a specific resolver, trace delegation from the root, and test a zone transfer.
The John the Ripper quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Identify a hash, convert a ZIP or SSH key with a *2john script, run wordlist and rule attacks, crack NT and sha512crypt, mask a known pattern, fork across CPU cores, and read the pot file honestly.
The ldapsearch quick reference: the flags, a modular copy-paste cheat sheet, and a worked breakdown of every real task. Find the base DN from the Root DSE, bind anonymously or with credentials, list users and groups, enumerate computers, hunt Kerberoastable accounts, page past a size limit, and query over LDAPS.
A practical Metasploit guide: install it, verify it, search modules, set options safely, validate findings with auxiliary checks, and keep a cheat sheet you will actually reuse.
A practical msfvenom guide: install it, verify it, pick a payload, set LHOST and LPORT, choose a format, generate controlled lab payloads, pair them with a handler, and keep a cheat sheet you will actually reuse.
The tcpdump quick reference: install and verify, the flags you actually use, a modular BPF cheat sheet, and one command per real situation. Isolate one host, watch a single service, catch DNS, filter by direction or protocol, read clear-text payload, save a clean PCAP for Wireshark, and rotate long captures unattended.
The dnsenum quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Pull records and name servers, test a zone transfer, brute force subdomains, pick a resolver for split-horizon DNS, sweep netranges, grow a wordlist, and export XML for your notes.
The feroxbuster quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Run recursive content discovery, cap depth, filter soft-404 noise by size or words, add extensions, scan authenticated with a cookie, follow redirects, proxy through Burp, save JSON, and resume an interrupted scan.
The radare2 quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Load and analyze a binary, list functions, strings, and imports, disassemble main, read control flow in graph mode, patch a jump, debug under breakpoints, diff two builds, and script it with r2pipe.
A practical pwntools guide: install it, wire up process and remote I/O, pack and unpack values, build ROP helpers, read the output honestly, and keep a cheat sheet you will actually reuse.
The GDB quick reference with GEF and pwndbg: launch flags, a modular cheat sheet, and a worked breakdown of every real situation. Break on a stripped binary, step by instruction, read args in registers, dump the stack, watch a variable, measure an overflow offset with cyclic, inspect the heap, and debug a core dump post-mortem.
The Wfuzz quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Fuzz paths, query and POST parameters, headers, cookies, and virtual hosts, filter custom-404 noise by size, brute a login with two markers, encode payloads on the fly, and proxy through Burp.
The RustScan quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Sweep all 65535 TCP ports in seconds, hand the open ones to Nmap for versions and scripts, scan a subnet or a file of hosts, fix too many open files, tune speed on a laggy link, and pull a greppable port list.
The pspy quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Transfer the static binary, watch processes and cron fire in real time without root, catch a UID=0 root timer, save and grep the feed for root commands, and turn a writable cron script into a privilege-escalation lead.
The LinPEAS quick reference: the flags that matter, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Deliver the script to a target, run and save a clean no-color report, tune the depth (stealth, all-checks, extra, regex), scope checks by group or MITRE technique, grep the high-signal findings, and read the color legend honestly.
The LinEnum quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Deliver the script to a foothold, run default vs thorough, hunt keywords, export files, write a report, and read the sudo, SUID/SGID, cron, and creds sections that matter.
The hash-identifier quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Turn an unknown hash into the right hashcat -m mode or john --format, triage a mixed dump, read prefixes like $6$ and $2y$, break the MD5-vs-NTLM tie, and hand the type straight to a cracker.
A practical Chisel guide: tunnel TCP and UDP over HTTP, build a reverse SOCKS pivot from a foothold, reach internal hosts, and keep the noise low in a lab.
The Binwalk quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Map firmware with a signature scan, extract nested layers recursively, carve a byte range with dd, read entropy for compression vs encryption, filter to just the filesystem, and identify a raw blob's CPU architecture.
The SearchSploit quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Search by product and version, match a CVE, pin a strict version, filter DoS noise, read code in the pager, mirror an exploit, output JSON, and triage straight from an Nmap scan.
The Nmap quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Ping-sweep a subnet, scan all 65535 ports, fingerprint service versions, run safe NSE scripts, scan UDP, get past a blocked ping, and save output for your notes.
The Hashcat quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Pick the exact hash mode, run dictionary, rule, mask, and hybrid attacks, crack NTLM, sha512crypt, WPA, and Kerberoast hashes, read the status screen, and resume long jobs.
The DNSRecon quick reference: modes, flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Pull standard records, test a zone transfer, brute force subdomains, reverse an IP range, walk a DNSSEC zone, pin a resolver, and save CSV/JSON you can diff.
The rpcclient quick reference: connection flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Open a null session, enumerate users, groups, RIDs, and shares, read the password policy, map names to SIDs, RID-cycle, authenticate with an NT hash, and read NT_STATUS errors honestly.
The curl quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. POST JSON, follow redirects, reuse cookies, pin DNS, resume a download, ignore a self-signed cert, time a slow endpoint, and proxy through Burp.
The Gobuster quick reference: modes, flags, a modular cheat sheet, and a worked breakdown of every real task. Brute-force directories and files, discover vhosts and DNS subdomains, filter false positives by status and length, fuzz with the FUZZ keyword, route through Burp, and enumerate open S3 buckets.
A practical Impacket guide: install it, verify it, pick the right script, handle credential and hash syntax cleanly, read protocol errors honestly, and keep a cheat sheet you will actually reuse.
The WPScan quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Enumerate users, find vulnerable plugins and themes, pull exposed config backups, run an authorized login attack, tune detection-mode noise, and parse the JSON with jq.
The smbclient quick reference: flags, a modular cheat sheet, and a worked breakdown of every real situation. List shares over a null session, browse a share interactively, pull one file or a whole tree, pass-the-hash, force an SMB dialect, grab a share as a tar, and debug a refused connection.
The WhatWeb quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Fingerprint a target, tune aggression, chase redirects to the real app, hit a vhost by Host header, scan a list, proxy through Burp, and save structured JSON.
The ffuf quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Fuzz directories and extensions, discover hidden parameters and virtual hosts, fuzz JSON and login bodies, calibrate away catch-all pages, filter by size, words, or regex, recurse, and replay a captured request.
A practical Responder guide: install it, pick the right interface, start in analyze mode, capture lab name-resolution traffic safely, read the output honestly, and keep a cheat sheet you will actually reuse.
The SecLists quick reference: the folders that matter, the file tools and flags you pair with a list, and a modular cheat sheet. Pick a web-content list, brute subdomains, fuzz a vhost, feed ffuf and gobuster, run a gentle Hydra login test, crack hashes offline, and carve a big list into a focused slice.
The netcat quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Check a port, grab a banner, hand-speak HTTP or SMTP, scan a small range, move a file or a whole directory between lab hosts, dial through a SOCKS proxy, and catch a reverse shell.
The Amass quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real recon situation. Enumerate subdomains passively then actively, load API keys for real coverage, brute force names, pull JSON with jq, find related domains by WHOIS/ASN/CIDR, diff the stored database, and validate before you scan.
The testssl.sh quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Confirm old protocols are off, read the certificate chain, run every named-vuln check, list ciphers, scan STARTTLS mail ports, and pin one backend behind a load balancer.
The Hydra quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Test SSH/FTP/SMB/RDP and database logins, brute an HTTP form with a fail or success marker, spray one password lockout-safe, tune tasks and rate, save hits, and resume an aborted run, all inside scope.
The theHarvester quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Pull subdomains from certificate transparency, scrape hosts and emails from search engines, resolve and validate leads with DNS, page a noisy source, wire in API keys, save JSON for jq, and run it in Docker.
The DIRB quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real scan. Run a first pass, append extensions, scope one directory, scan behind basic auth, reuse a session cookie, proxy through Burp, and survive a wildcard server.
The sslscan quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Scan a non-standard TLS port, upgrade a STARTTLS mail service, set SNI on a shared host, check for Heartbleed, read the cipher and certificate output, and diff a hardening change over time.
find/grep filesystem enumeration plus John cracking of GPG-encrypted files and hashes harvests reused credentials for lateral movement across users, then unrestricted sudo grants root.
Layered web encoding (Base64/Brainfuck/QR) leaks usernames for FTP brute-force, an SSH key upload yields a shell, then a PATH-hijacked SUID binary gives root.
A WordPress login brute-forced with wpscan plants a PHP reverse shell in a theme's 404.php, then passwordless sudo nmap escalates to root.
Type to search · / or Ctrl+K to open · ↑↓ to move · Enter to open · Esc to close
