"Knowledge is powerful, be careful how you use it!"
A collection of awesome lists, manuals, blogs, hacks, one-liners, cli/web tools and more.
📔 What is it?
This list is a collection of various materials that I use every day in my work. It contains a lot of useful information gathered in one piece.
🚻 For whom?
It is intended for everyone and anyone but especially for System and Network Administrators, DevOps, Pentesters and Security Researchers.
ℹ️ Contributing
If you find something which doesn't make sense, or one of these doesn't seem right, or something seems really stupid; please make a pull request or please add valid and well-reasoned opinions about your changes or comments.
A few simple rules for this project:
- inviting and clear
- not tiring
- useful
These below rules may be better:
- easy to contribute to (Markdown + HTML ...)
- easy to find (simple TOC, maybe it's worth extending them?)
Url marked * is temporary unavailable. Please don't delete it without confirming that it has permanently expired.
Before add pull request please see this. All suggestions/PR are welcome!
💝 Support
If this project is useful and important for you or if you really like the-book-of-secret-knowledge, you can bring me more positive energy, give me some good words or support this project more. Thank you!
☑️ Todo
- Add useful shell functions
- Add one-liners for collection tools (eg. CLI Tools)
💢 Table of Contents
Only main chapters:
- CLI Tools
- GUI Tools
- Web Tools
- Systems/Services
- Networks
- Manuals/Howtos/Tutorials
- Inspiring Lists
- Blogs
- Hacking/Penetration Testing
- Your daily knowledge and news
- Other Cheat Sheets
- One-liners
🔱 The Book of Secret Knowledge (Chapters)
[TOC]
CLI Tools▪️ Shells
▪️ Managers
▪️ Text editors
▪️ Network
▪️ Network (DNS)
▪️ Network (HTTP)
▪️ SSL/Security
▪️ Auditing Tools
▪️ System Diagnostics/Debuggers
▪️ Log Analyzers
▪️ Databases
▪️ TOR
▪️ Other
[TOC]
GUI Tools▪️ Terminal emulators
▪️ Network
▪️ Browsers
▪️ Password Managers
▪️ Messengers/IRC Clients
▪️ Messengers (end-to-end encryption)
▪️ Text editors
[TOC]
Web Tools▪️ Browsers
▪️ SSL/Security
▪️ HTTP Headers & Web Linters
▪️ DNS
▪️ Mail
▪️ Encoders/Decoders and Regex testing
▪️ Net-tools
▪️ Privacy
▪️ Code parsers/playgrounds
▪️ Performance
▪️ Mass scanners (search engines)
▪️ Passwords
▪️ CVE/Exploits databases
▪️ Mobile apps scanners
▪️ Private Search Engines
▪️ Secure WebMail Providers
▪️ Crypto
▪️ PGP Keyservers
▪️ Other
[TOC]
Systems/Services▪️ Operating Systems
▪️ HTTP(s) Services
▪️ Security/hardening
[TOC]
Networks▪️ Tools
▪️ Labs
[TOC]
Manuals/Howtos/Tutorials▪️ Shells/Command line
▪️ Python
▪️ Sed & Awk & Other
▪️ *nix & Network
▪️ Large-scale systems
▪️ System hardening
▪️ Security & Privacy
▪️ Web Apps
▪️ Other
[TOC]
Inspiring Lists▪️ SysOps/DevOps
▪️ Developers
▪️ Security/Pentesting
[TOC]
Blogs▪️ Geeky Persons
▪️ Geeky Blogs
▪️ A piece of history
[TOC]
Hacking/Penetration Testing▪️ Pentesters arsenal tools
▪️ Pentests bookmarks collection
▪️ Wordlists and Weak passwords
▪️ Bounty programs
▪️ Web Training Apps (local installation)
▪️ Labs (ethical hacking platforms/trainings/CTFs)
▪️ Other resources
[TOC]
Your daily knowledge and news▪️ RSS Readers
▪️ IRC Channels
▪️ Security
[TOC]
Other Cheat SheetsBuild your own DNS Servers
Build your own Certificate Authority
Build your own System/Virtual Machine
DNS Servers list (privacy)
IP | URL |
---|---|
84.200.69.80 |
dns.watch |
94.247.43.254 |
opennic.org |
64.6.64.6 |
verisign.com |
89.233.43.71 |
censurfridns.dk |
1.1.1.1 |
cloudflare.com |
94.130.110.185 |
dnsprivacy.at |
TOP Browser extensions
Extension name | Description |
---|---|
IPvFoo |
Display the server IP address and HTTPS information across all page elements. |
FoxyProxy |
Simplifies configuring browsers to access proxy-servers. |
HTTPS Everywhere |
Automatically use HTTPS security on many sites. |
uMatrix |
Point & click to forbid/allow any class of requests made by your browser. |
uBlock Origin |
An efficient blocker: easy on memory and CPU footprint. |
Session Buddy |
Manage browser tabs and bookmarks with ease. |
SuperSorter |
Sort bookmarks recursively, delete duplicates, merge folders and more. |
Clear Cache |
Clear your cache and browsing data. |
d3coder |
Encoding/Decoding plugin for various types of encoding. |
Web Developer |
Adds a toolbar button with various web developer tools. |
ThreatPinch Lookup |
Add threat intelligence hover tool tips. |
TOP Burp extensions
Extension name | Description |
---|---|
Autorize |
Automatically detects authorization enforcement. |
Reflection |
An efficient blocker: easy on memory and CPU footprint. |
Logger++ |
Logs requests and responses for all Burp tools in a sortable table. |
Bypass WAF |
Adds headers useful for bypassing some WAF devices. |
JSON Beautifier |
Beautifies JSON content in the HTTP message viewer. |
JSON Web Tokens |
Enables Burp to decode and manipulate JSON web tokens. |
CSP Auditor |
Displays CSP headers for responses, and passively reports CSP weaknesses. |
CSP-Bypass |
Passively scans for CSP headers that contain known bypasses.. |
Hackvertor |
Converts data using a tag-based configuration to apply various encoding. |
Active Scan++ |
Extends Burp's active and passive scanning capabilities. |
HTML5 Auditor |
Scans for usage of risky HTML5 features. |
Software Vulnerability Scanner |
Software vulnerability scanner based on Vulners.com audit API. |
[TOC]
One-linersTable of Contents
terminal
Tool:Reload shell without exit
exec $SHELL -l
Close shell keeping all subprocess running
disown -a && exit
Exit without saving shell history
kill -9 $$
unset HISTFILE && exit
Perform a branching conditional
true && echo success
false || echo failed
Pipe stdout and stderr to separate commands
some_command > >(/bin/cmd_for_stdout) 2> >(/bin/cmd_for_stderr)
Redirect stdout and stderr each to separate files and print both to the screen
(some_command 2>&1 1>&3 | tee errorlog ) 3>&1 1>&2 | tee stdoutlog
List of commands you use most often
history | \
awk '{CMD[$2]++;count++;}END { for (a in CMD)print CMD[a] " " CMD[a]/count*100 "% " a;}' | \
grep -v "./" | \
column -c3 -s " " -t | \
sort -nr | nl | head -n 20
Quickly backup a file
cp filename{,.orig}
Empty a file (truncate to 0 size)
>filename
Delete all files in a folder that don't match a certain file extension
rm !(*.foo|*.bar|*.baz)
Pass multi-line string to a file
# cat >filename ... - overwrite file
# cat >>filename ... - append to file
cat > filename << __EOF__
data data data
__EOF__
Edit a file on a remote host using vim
vim scp://user@host//etc/fstab
Create a directory and change into it at the same time
mkd() { mkdir -p "$@" && cd "$@"; }
Convert uppercase files to lowercase files
rename 'y/A-Z/a-z/' *
Print a row of characters across the terminal
printf "%`tput cols`s" | tr ' ' '#'
Show shell history without line numbers
history | cut -c 8-
fc -l -n 1 | sed 's/^\s*//'
Run command(s) after exit session
cat > /etc/profile << __EOF__
_after_logout() {
username=$(whoami)
for _pid in $(ps afx | grep sshd | grep "$username" | awk '{print $1}') ; do
kill -9 $_pid
done
}
trap _after_logout EXIT
__EOF__
Generate a sequence of numbers
for ((i=1; i<=10; i+=2)) ; do echo $i ; done
# alternative: seq 1 2 10
for ((i=5; i<=10; ++i)) ; do printf '%02d\n' $i ; done
# alternative: seq -w 5 10
mount
Tool:Mount a temporary ram partition
mount -t tmpfs tmpfs /mnt -o size=64M
-t
- filesystem type-o
- mount options
Remount a filesystem as read/write
mount -o remount,rw /
fuser
Tool:Kills a process that is locking a file
fuser -k filename
Show what PID is listening on specific port
fuser -v 53/udp
ps
Tool:Show a 4-way scrollable process tree with full details
ps awwfux | less -S
Processes per user counter
ps hax -o user | sort | uniq -c | sort -r
find
Tool:Find files that have been modified on your system in the past 60 minutes
find / -mmin 60 -type f
Find all files larger than 20M
find / -type f -size +20M
Find duplicate files (based on MD5 hash)
find -type f -exec md5sum '{}' ';' | sort | uniq --all-repeated=separate -w 33
Change permission only for files
cd /var/www/site && find . -type f -exec chmod 766 {} \;
cd /var/www/site && find . -type f -exec chmod 664 {} +
Change permission only for directories
cd /var/www/site && find . -type d -exec chmod g+x {} \;
cd /var/www/site && find . -type d -exec chmod g+rwx {} +
Find files and directories for specific user
find . -user <username> -print
Find files and directories for all without specific user
find . \!-user <username> -print
Delete older files than 60 days
find . -type f -mtime +60 -delete
Recursively remove all empty sub-directories from a directory
find . -depth -type d -empty -exec rmdir {} \;
How to find all hard links to a file
find </path/to/dir> -xdev -samefile filename
Recursively find the latest modified files
find . -type f -exec stat --format '%Y :%y %n' "{}" \; | sort -nr | cut -d: -f2- | head
Recursively find/replace of a string with sed
find . -not -path '*/\.git*' -type f -print0 | xargs -0 sed -i 's/foo/bar/g'
top
Tool:Use top to monitor only all processes with the specific string
top -p $(pgrep -d , <str>)
<str>
- process containing str (eg. nginx, worker)
strace
Tool:Track child process
strace -f -p $(pidof glusterfsd)
Track process after 30 seconds
timeout 30 strace $(< /var/run/zabbix/zabbix_agentd.pid)
Track child process and redirect output to a file
ps auxw | grep 'sbin/[a]pache' | awk '{print " -p " $2}' | xargs strace -o /tmp/strace-apache-proc.out
Track the open request of a network port
strace -f -e trace=bind nc -l 80
Track the open request of a network port (show TCP/UDP)
strace -f -e trace=network nc -lu 80
kill
Tool:Kill a process running on port
kill -9 $(lsof -i :<port> | awk '{l=$2} END {print l}')
diff
Tool:Compare two directory trees
diff <(cd directory1 && find | sort) <(cd directory2 && find | sort)
tail
Tool:Annotate tail -f with timestamps
tail -f file | while read ; do echo "$(date +%T.%N) $REPLY" ; done
Analyse an Apache access log for the most common IP addresses
tail -10000 access_log | awk '{print $1}' | sort | uniq -c | sort -n | tail
Analyse web server log and show only 5xx http codes
tail -n 100 -f /path/to/logfile | grep "HTTP/[1-2].[0-1]\" [5]"
tar
Tool:System backup with exclude specific directories
cd /
tar -czvpf /mnt/system$(date +%d%m%Y%s).tgz --directory=/ \
--exclude=proc/* --exclude=sys/* --exclude=dev/* --exclude=mnt/* .
System backup with exclude specific directories (pigz)
cd /
tar cvpf /backup/snapshot-$(date +%d%m%Y%s).tgz --directory=/ \
--exclude=proc/* --exclude=sys/* --exclude=dev/* \
--exclude=mnt/* --exclude=tmp/* --use-compress-program=pigz .
dump
Tool:System backup to file
dump -y -u -f /backup/system$(date +%d%m%Y%s).lzo /
Restore system from lzo file
cd /
restore -rf /backup/system$(date +%d%m%Y%s).lzo
cpulimit
Tool:Limit the cpu usage of a process
cpulimit -p pid -l 50
pwdx
Tool:Show current working directory of a process
pwdx <pid>
taskset
Tool:Start a command on only one CPU core
taskset -c 0 <command>
tr
Tool:Show directories in the PATH, one per line
tr : '\n' <<<$PATH
chmod
Tool:Remove executable bit from all files in the current directory
chmod -R -x+X *
Restore permission for /bin/chmod
# 1:
cp /bin/ls chmod.01
cp /bin/chmod chmod.01
./chmod.01 700 file
# 2:
/bin/busybox chmod 0700 /bin/chmod
# 3:
setfacl --set u::rwx,g::---,o::--- /bin/chmod
who
Tool:Find last reboot time
who -b
Detect a user sudo-su'd into the current shell
[[ $(who -m | awk '{ print $1 }') == $(whoami) ]] || echo "You are su-ed to $(whoami)"
last
Tool:Was the last reboot a panic?
(last -x -f $(ls -1t /var/log/wtmp* | head -2 | tail -1); last -x -f /var/log/wtmp) | grep -A1 reboot | head -2 | grep -q shutdown && echo "Expected reboot" || echo "Panic reboot"
screen
Tool:Start screen in detached mode
screen -d -m [<command>]
du
Tool:Show 20 biggest directories with 'K M G'
du | \
sort -r -n | \
awk '{split("K M G",v); s=1; while($1>1024){$1/=1024; s++} print int($1)" "v[s]"\t"$2}' | \
head -n 20
inotifywait
Tool:Init tool everytime a file in a directory is modified
while true ; do inotifywait -r -e MODIFY dir/ && ls dir/ ; done;
openssl
Tool:Testing connection to remote host
echo | openssl s_client -connect google.com:443 -showcerts
Testing connection to remote host (with SNI support)
echo | openssl s_client -showcerts -servername google.com -connect google.com:443
Testing connection to remote host with specific ssl version
openssl s_client -tls1_2 -connect google.com:443
Testing connection to remote host with specific ssl cipher
openssl s_client -cipher 'AES128-SHA' -connect google.com:443
Generate private key
# _len: 2048, 4096
( _fd="private.key" ; _len="4096" ; \
openssl genrsa -out ${_fd} ${_len} )
Generate private key with passphrase
# _ciph: des3, aes128, aes256
# _len: 2048, 4096
( _ciph="aes128" ; _fd="private.key" ; _len="4096" ; \
openssl genrsa -${_ciph} -out ${_fd} ${_len} )
Remove passphrase from private key
( _fd="private.key" ; _fd_unp="private_unp.key" ; \
openssl rsa -in ${_fd} -out ${_fd_unp} )
Encrypt existing private key with a passphrase
# _ciph: des3, aes128, aes256
( _ciph="aes128" ; _fd="private.key" ; _fd_pass="private_pass.key" ; \
openssl rsa -${_ciph} -in ${_fd} -out ${_fd_pass}
Check private key
( _fd="private.key" ; \
openssl rsa -check -in ${_fd} )
Get public key from private key
( _fd="private.key" ; _fd_pub="public.key" ; \
openssl rsa -pubout -in ${_fd} -out ${_fd_pub} )
Generate private key + csr
( _fd="private.key" ; _fd_csr="request.csr" ; _len="4096" ; \
openssl req -out ${_fd_csr} -new -newkey rsa:${_len} -nodes -keyout ${_fd} )
Generate csr
( _fd="private.key" ; _fd_csr="request.csr" ; \
openssl req -out ${_fd_csr} -new -key ${_fd} )
Generate csr (metadata from exist certificate)
( _fd="private.key" ; _fd_csr="request.csr" ; _fd_crt="cert.crt" ; \
openssl x509 -x509toreq -in ${_fd_crt} -out ${_fd_csr} -signkey ${_fd} )
Generate csr with -config param
( _fd="private.key" ; _fd_csr="request.csr" ; \
openssl req -new -sha256 -key ${_fd} -out ${_fd_csr} \
-config <(
cat <<-EOF
[req]
default_bits = 2048
prompt = no
default_md = sha256
req_extensions = req_ext
distinguished_name = dn
[ dn ]
C=<two-letter ISO abbreviation for your country>
ST=<state or province where your organization is legally located>
L=<city where your organization is legally located>
O=<legal name of your organization>
OU=<section of the organization>
CN=<fully qualified domain name>
[ req_ext ]
subjectAltName = @alt_names
[ alt_names ]
DNS.1 = <fully qualified domain name>
DNS.2 = <next domain>
DNS.3 = <next domain>
EOF
))
List available EC curves
openssl ecparam -list_curves
Generate ECDSA private key
# _curve: prime256v1, secp521r1, secp384r1
( _fd="private.key" ; _curve="prime256v1" ; \
openssl ecparam -out ${_fd} -name ${_curve} -genkey )
# _curve: X25519
( _fd="private.key" ; _curve="x25519" ; \
openssl genpkey -algorithm ${_curve} -out ${_fd} )
Print ECDSA private and public keys
( _fd="private.key" ; \
openssl ec -in ${_fd} -noout -text )
# For x25519 only extracting public key
( _fd="private.key" ; _fd_pub="public.key" ; \
openssl pkey -in ${_fd} -pubout -out ${_fd_pub} )
Generate private key with csr (ECC)
# _curve: prime256v1, secp521r1, secp384r1
( _fd="domain.com.key" ; _fd_csr="domain.com.csr" ; _curve="prime256v1" ; openssl ecparam -out ${_fd} -name ${_curve} -genkey ; openssl req -new -key ${_fd} -out ${_fd_csr} -sha256 )
Convert DER to PEM
( _fd_der="cert.crt" ; _fd_pem="cert.pem" ; \
openssl x509 -in ${_fd_der} -inform der -outform pem -out ${_fd_pem} )
Convert PEM to DER
( _fd_der="cert.crt" ; _fd_pem="cert.pem" ; \
openssl x509 -in ${_fd_pem} -outform der -out ${_fd_der} )
Checking whether the private key and the certificate match
(openssl rsa -noout -modulus -in private.key | openssl md5 ; openssl x509 -noout -modulus -in certificate.crt | openssl md5) | uniq
secure-delete
Tool:Secure delete with shred
shred -vfuz -n 10 file
shred --verbose --random-source=/dev/urandom -n 1 /dev/sda
Secure delete with scrub
scrub -p dod /dev/sda
scrub -p dod -r file
Secure delete with badblocks
badblocks -s -w -t random -v /dev/sda
badblocks -c 10240 -s -w -t random -v /dev/sda
Secure delete with secure-delete
srm -vz /tmp/file
sfill -vz /local
sdmem -v
swapoff /dev/sda5 && sswap -vz /dev/sda5
dd
Tool:Show dd status every so often
dd <dd_params> status=progress
watch --interval 5 killall -USR1 dd
Redirect output to a file with dd
echo "string" | dd of=filename
curl
Tool:curl -Iks https://www.google.com
-I
- show response headers only-k
- insecure connection when using ssl-s
- silent mode (not display body)
curl -Iks --location -X GET -A "x-agent" https://www.google.com
--location
- follow redirects-X
- set method-A
- set user-agent
curl -Iks --location -X GET -A "x-agent" --proxy http://127.0.0.1:16379 https://www.google.com
--proxy [socks5://|http://]
- set proxy server
Check DNS and HTTP trace with headers for specific domains
### Set domains and external dns servers.
_domain_list=(google.com) ; _dns_list=("8.8.8.8" "1.1.1.1")
for _domain in "${_domain_list[@]}" ; do
printf '=%.0s' {1..48}
echo
printf "[\\e[1;32m+\\e[m] resolve: %s\\n" "$_domain"
for _dns in "${_dns_list[@]}" ; do
# Resolve domain.
host "${_domain}" "${_dns}"
echo
done
for _proto in http https ; do
printf "[\\e[1;32m+\\e[m] trace + headers: %s://%s\\n" "$_proto" "$_domain"
# Get trace and http headers.
curl -Iks -A "x-agent" --location "${_proto}://${_domain}"
echo
done
done
unset _domain_list _dns_list
httpie
Tool:http -p Hh https://www.google.com
-p
- print request and response headersH
- request headersB
- request bodyh
- response headersb
- response body
http -p Hh --follow --max-redirects 5 --verify no https://www.google.com
-F, --follow
- follow redirects--max-redirects N
- maximum for--follow
--verify no
- skip SSL verification
http -p Hh --follow --max-redirects 5 --verify no --proxy http:http://127.0.0.1:16379 https://www.google.com
--proxy [http:]
- set proxy server
ssh
Tool:Escape Sequence
# Supported escape sequences:
~. - terminate connection (and any multiplexed sessions)
~B - send a BREAK to the remote system
~C - open a command line
~R - Request rekey (SSH protocol 2 only)
~^Z - suspend ssh
~# - list forwarded connections
~& - background ssh (when waiting for connections to terminate)
~? - this message
~~ - send the escape character by typing it twice
Compare a remote file with a local file
ssh user@host cat /path/to/remotefile | diff /path/to/localfile -
SSH connection through host in the middle
ssh -t reachable_host ssh unreachable_host
Run command over ssh on remote host
cat > cmd.txt << __EOF__
cat /etc/hosts
__EOF__
ssh host -l user $(<cmd.txt)
Get public key from private key
ssh-keygen -y -f ~/.ssh/id_rsa
Get all fingerprints
ssh-keygen -l -f .ssh/known_hosts
Ssh authentication with user password
ssh -o PreferredAuthentications=password -o PubkeyAuthentication=no user@remote_host
Ssh authentication with publickey
ssh -o PreferredAuthentications=publickey -o PubkeyAuthentication=yes -i id_rsa user@remote_host
Simple recording SSH session
function _ssh_sesslog() {
_sesdir="<path/to/session/logs>"
mkdir -p "${_sesdir}" && \
ssh $@ 2>&1 | tee -a "${_sesdir}/$(date +%Y%m%d).log"
}
# Alias:
alias ssh='_ssh_sesslog'
Using Keychain for SSH logins
### Delete all of ssh-agent's keys.
function _scl() {
/usr/bin/keychain --clear
}
### Add key to keychain.
function _scg() {
/usr/bin/keychain /path/to/private-key
source "$HOME/.keychain/$HOSTNAME-sh"
}
SSH login without processing any login scripts
ssh -tt user@host bash
SSH local port forwarding
Example 1:
# Forwarding our local 2250 port to nmap.org:443 from localhost through localhost
host1> ssh -L 2250:nmap.org:443 localhost
# Connect to the service:
host1> curl -Iks --location -X GET https://localhost:2250
Example 2:
# Forwarding our local 9051 port to db.d.x:5432 from localhost through node.d.y
host1> ssh -nNT -L 9051:db.d.x:5432 node.d.y
# Connect to the service:
host1> psql -U db_user -d db_dev -p 9051 -h localhost
-n
- redirects stdin from/dev/null
-N
- do not execute a remote command-T
- disable pseudo-terminal allocation
SSH remote port forwarding
# Forwarding our local 9051 port to db.d.x:5432 from host2 through node.d.y
host1> ssh -nNT -R 9051:db.d.x:5432 node.d.y
# Connect to the service:
host2> psql -U postgres -d postgres -p 8000 -h localhost
linux-dev
Tool:Testing remote connection to port
timeout 1 bash -c "</dev/<proto>/<host>/<port>" >/dev/null 2>&1 ; echo $?
<proto
- set protocol (tcp/udp)<host>
- set remote host<port>
- set destination port
Read and write to TCP or UDP sockets with common bash tools
exec 5<>/dev/tcp/<host>/<port>; cat <&5 & cat >&5; exec 5>&-
tcpdump
Tool:Filter incoming (on interface) traffic (specific ip:port)
tcpdump -ne -i eth0 -Q in host 192.168.252.1 and port 443
-n
- don't convert addresses (-nn
will not resolve hostnames or ports)-e
- print the link-level headers-i [iface|any]
- set interface-Q|-D [in|out|inout]
- choose send/receive direction (-D
- for old tcpdump versions)host [ip|hostname]
- set host, also[host not]
[and|or]
- set logicport [1-65535]
- set port number, also[port not]
Filter incoming (on interface) traffic (specific ip:port) and write to a file
tcpdump -ne -i eth0 -Q in host 192.168.252.1 and port 443 -c 5 -w tcpdump.pcap
-c [num]
- capture only num number of packets-w [filename]
- write packets to file,-r [filename]
- reading from file
Capture all ICMP packets
tcpdump -nei eth0 icmp
Check protocol used (TCP or UDP) for service
tcpdump -nei eth0 tcp port 22 -vv -X | egrep "TCP|UDP"
Display ASCII text (to parse the output using grep or other)
tcpdump -i eth0 -A -s0 port 443
Grab everything between two keywords
tcpdump -i eth0 port 80 -X | sed -n -e '/username/,/=ldap/ p'
Grab user and pass ever plain http
tcpdump -i eth0 port http -l -A | egrep -i 'pass=|pwd=|log=|login=|user=|username=|pw=|passw=|passwd=|password=|pass:|user:|username:|password:|login:|pass |user ' --color=auto --line-buffered -B20
Extract HTTP User Agent from HTTP request header
tcpdump -ei eth0 -nn -A -s1500 -l | grep "User-Agent:"
Capture only HTTP GET and POST packets
tcpdump -ei eth0 -s 0 -A -vv 'tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x47455420' or 'tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x504f5354'
or simply:
tcpdump -ei eth0 -s 0 -v -n -l | egrep -i "POST /|GET /|Host:"
Rotate capture files
tcpdump -ei eth0 -w /tmp/capture-%H.pcap -G 3600 -C 200
-G <num>
- pcap will be created every<num>
seconds-C <size>
- close the current pcap and open a new one if is larger than<size>
Top hosts by packets
tcpdump -ei enp0s25 -nnn -t -c 200 | cut -f 1,2,3,4 -d '.' | sort | uniq -c | sort -nr | head -n 20
tcpick
Tool:Analyse packets in real-time
while true ; do tcpick -a -C -r dump.pcap ; sleep 2 ; clear ; done
ngrep
Tool:ngrep -d eth0 "www.google.com" port 443
-d [iface|any]
- set interface[domain]
- set hostnameport [1-65535]
- set port number
ngrep -d eth0 "www.google.com" (host 10.240.20.2) and (port 443)
(host [ip|hostname])
- filter by ip or hostname(port [1-65535])
- filter by port number
ngrep -d eth0 -qt -O ngrep.pcap "www.google.com" port 443
-q
- quiet mode (only payloads)-t
- added timestamps-O [filename]
- save output to file,-I [filename]
- reading from file
ngrep -d eth0 -qt 'HTTP' 'tcp'
HTTP
- show http headerstcp|udp
- set protocol[src|dst] host [ip|hostname]
- set direction for specific node
ngrep -l -q -d eth0 -i "User-Agent: curl*"
-l
- stdout line buffered-i
- case-insensitive search
hping3
Tool:hping3 -V -p 80 -s 5050 <scan_type> www.google.com
-V|--verbose
- verbose mode-p|--destport
- set destination port-s|--baseport
- set source port<scan_type>
- set scan type-F|--fin
- set FIN flag, port open if no reply-S|--syn
- set SYN flag-P|--push
- set PUSH flag-A|--ack
- set ACK flag (use when ping is blocked, RST response back if the port is open)-U|--urg
- set URG flag-Y|--ymas
- set Y unused flag (0x80 - nullscan), port open if no reply-M 0 -UPF
- set TCP sequence number and scan type (URG+PUSH+FIN), port open if no reply
hping3 -V -c 1 -1 -C 8 www.google.com
-c [num]
- packet count-1
- set ICMP mode-C|--icmptype [icmp-num]
- set icmp type (default icmp-echo = 8)
hping3 -V -c 1000000 -d 120 -S -w 64 -p 80 --flood --rand-source <remote_host>
--flood
- sent packets as fast as possible (don't show replies)--rand-source
- random source address mode-d --data
- data size-w|--win
- winsize (default 64)
nmap
Tool:Ping scans the network
nmap -sP 192.168.0.0/24
Show only open ports
nmap -F --open 192.168.0.0/24
Full TCP port scan using with service version detection
nmap -p 1-65535 -sV -sS -T4 192.168.0.0/24
Nmap scan and pass output to Nikto
nmap -p80,443 192.168.0.0/24 -oG - | nikto.pl -h -
Recon specific ip:service with Nmap NSE scripts stack
# Set variables:
_hosts="192.168.250.10"
_ports="80,443"
# Set Nmap NSE scripts stack:
_nmap_nse_scripts="+dns-brute,\
+http-auth-finder,\
+http-chrono,\
+http-cookie-flags,\
+http-cors,\
+http-cross-domain-policy,\
+http-csrf,\
+http-dombased-xss,\
+http-enum,\
+http-errors,\
+http-git,\
+http-grep,\
+http-internal-ip-disclosure,\
+http-jsonp-detection,\
+http-malware-host,\
+http-methods,\
+http-passwd,\
+http-phpself-xss,\
+http-php-version,\
+http-robots.txt,\
+http-sitemap-generator,\
+http-shellshock,\
+http-stored-xss,\
+http-title,\
+http-unsafe-output-escaping,\
+http-useragent-tester,\
+http-vhosts,\
+http-waf-detect,\
+http-waf-fingerprint,\
+http-xssed,\
+traceroute-geolocation.nse,\
+ssl-enum-ciphers,\
+whois-domain,\
+whois-ip"
# Set Nmap NSE script params:
_nmap_nse_scripts_args="dns-brute.domain=${_hosts},http-cross-domain-policy.domain-lookup=true,http-waf-detect.aggro,http-waf-detect.detectBodyChanges,http-waf-fingerprint.intensive=1"
# Perform scan:
nmap --script="$_nmap_nse_scripts" --script-args="$_nmap_nse_scripts_args" -p "$_ports" "$_hosts"
netcat
Tool:nc -kl 5000
-l
- listen for an incoming connection-k
- listening after client has disconnected>filename.out
- save receive data to file (optional)
nc 192.168.0.1 5051 < filename.in
< filename.in
- send data to remote host
nc -vz 10.240.30.3 5000
-v
- verbose output-z
- scan for listening daemons
nc -vzu 10.240.30.3 1-65535
-u
- scan only udp ports
Transfer data file (archive)
server> nc -l 5000 | tar xzvfp -
client> tar czvfp - /path/to/dir | nc 10.240.30.3 5000
Launch remote shell
server> nc -l 5000 -e /bin/bash
client> nc 10.240.30.3 5000
Simple file server
while true ; do nc -l 5000 | tar -xvf - ; done
Simple minimal HTTP Server
while true ; do nc -l -p 1500 -c 'echo -e "HTTP/1.1 200 OK\n\n $(date)"' ; done
Simple HTTP Server
Restarts web server after each request - remove
while
condition for only single connection.
cat > index.html << __EOF__
<!doctype html>
<head>
<meta charset="utf-8">
<meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1">
<title></title>
<meta name="description" content="">
<meta name="viewport" content="width=device-width, initial-scale=1">
</head>
<body>
<p>
Hello! It's a site.
</p>
</body>
</html>
__EOF__
server> while : ; do \
(echo -ne "HTTP/1.1 200 OK\r\nContent-Length: $(wc -c <index.html)\r\n\r\n" ; cat index.html;) | \
nc -l -p 5000 \
; done
-p
- port number
Simple HTTP Proxy (single connection)
#!/usr/bin/env bash
if [[ $# != 2 ]] ; then
printf "%s\\n" \
"usage: ./nc-proxy listen-port bk_host:bk_port"
fi
_listen_port="$1"
_bk_host=$(echo "$2" | cut -d ":" -f1)
_bk_port=$(echo "$2" | cut -d ":" -f2)
printf " lport: %s\\nbk_host: %s\\nbk_port: %s\\n\\n" \
"$_listen_port" "$_bk_host" "$_bk_port"
_tmp=$(mktemp -d)
_back="$_tmp/pipe.back"
_sent="$_tmp/pipe.sent"
_recv="$_tmp/pipe.recv"
trap 'rm -rf "$_tmp"' EXIT
mkfifo -m 0600 "$_back" "$_sent" "$_recv"
sed "s/^/=> /" <"$_sent" &
sed "s/^/<= /" <"$_recv" &
nc -l -p "$_listen_port" <"$_back" | \
tee "$_sent" | \
nc "$_bk_host" "$_bk_port" | \
tee "$_recv" >"$_back"
server> chmod +x nc-proxy && ./nc-proxy 8080 192.168.252.10:8000
lport: 8080
bk_host: 192.168.252.10
bk_port: 8000
client> http -p h 10.240.30.3:8080
HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=31536000
Content-Length: 2748
Content-Type: text/html; charset=utf-8
Date: Sun, 01 Jul 2018 20:12:08 GMT
Last-Modified: Sun, 01 Apr 2018 21:53:37 GMT
Create a single-use TCP or UDP proxy
### TCP -> TCP
nc -l -p 2000 -c "nc [ip|hostname] 3000"
### TCP -> UDP
nc -l -p 2000 -c "nc -u [ip|hostname] 3000"
### UDP -> UDP
nc -l -u -p 2000 -c "nc -u [ip|hostname] 3000"
### UDP -> TCP
nc -l -u -p 2000 -c "nc [ip|hostname] 3000"
gnutls-cli
Tool:Testing connection to remote host (with SNI support)
gnutls-cli -p 443 google.com
Testing connection to remote host (without SNI support)
gnutls-cli --disable-sni -p 443 google.com
socat
Tool:Testing remote connection to port
socat - TCP4:10.240.30.3:22
-
- standard input (STDIO)TCP4:<params>
- set tcp4 connection with specific params[hostname|ip]
- set hostname/ip[1-65535]
- set port number
Redirecting TCP-traffic to a UNIX domain socket under Linux
socat TCP-LISTEN:1234,bind=127.0.0.1,reuseaddr,fork,su=nobody,range=127.0.0.0/8 UNIX-CLIENT:/tmp/foo
TCP-LISTEN:<params>
- set tcp listen with specific params[1-65535]
- set port numberbind=[hostname|ip]
- set bind hostname/ipreuseaddr
- allows other sockets to bind to an addressfork
- keeps the parent process attempting to produce more connectionssu=nobody
- set userrange=[ip-range]
- ip range
UNIX-CLIENT:<params>
- communicates with the specified peer socketfilename
- define socket
lsof
Tool:Show process that use internet connection at the moment
lsof -P -i -n
Show process that use specific port number
lsof -i tcp:443
Lists all listening ports together with the PID of the associated process
lsof -Pan -i tcp -i udp
List all open ports and their owning executables
lsof -i -P | grep -i "listen"
Show all open ports
lsof -Pnl -i
Show open ports (LISTEN)
lsof -Pni4 | grep LISTEN | column -t
List all files opened by a particular command
lsof -c "process"
View user activity per directory
lsof -u username -a +D /etc
Show 10 largest open files
lsof / | \
awk '{ if($7 > 1048576) print $7/1048576 "MB" " " $9 " " $1 }' | \
sort -n -u | tail | column -t
netstat
Tool:Graph # of connections for each hosts
netstat -an | \
grep ESTABLISHED | \
awk '{print $5}' | \
awk -F: '{print $1}' | \
grep -v -e '^[[:space:]]*$' | \
sort | uniq -c | \
awk '{ printf("%s\t%s\t",$2,$1) ; for (i = 0; i < $1; i++) {printf("*")}; print "" }'
Monitor open connections for specific port including listen, count and sort it per IP
watch "netstat -plan | grep :443 | awk {'print \$5'} | cut -d: -f 1 | sort | uniq -c | sort -nk 1"
rsync
Tool:Rsync remote data as root using sudo
rsync --rsync-path 'sudo rsync' username@hostname:/path/to/dir/ /local/
host
Tool:Resolves the domain name (using external dns server)
host google.com 9.9.9.9
Checks the domain administrator (SOA record)
host -t soa google.com 9.9.9.9
dig
Tool:Resolves the domain name (short output)
dig google.com +short
Lookup NS record for specific domain
dig @9.9.9.9 google.com NS
Query only answer section
dig google.com +nocomments +noquestion +noauthority +noadditional +nostats
Query ALL DNS Records
dig google.com ANY +noall +answer
DNS Reverse Look-up
dig -x 172.217.16.14 +short
certbot
Tool:Generate multidomain certificate
certbot certonly -d example.com -d www.example.com
Generate wildcard certificate
certbot certonly --manual --preferred-challenges=dns -d example.com -d *.example.com
Generate certificate with 4096 bit private key
certbot certonly -d example.com -d www.example.com --rsa-key-size 4096
network-other
Tool:Get all subnets for specific AS (Autonomous system)
AS="AS32934"
whois -h whois.radb.net -- "-i origin ${AS}" | \
grep "^route:" | \
cut -d ":" -f2 | \
sed -e 's/^[ \t]//' | \
sort -n -t . -k 1,1 -k 2,2 -k 3,3 -k 4,4 | \
cut -d ":" -f2 | \
sed -e 's/^[ \t]/allow /' | \
sed 's/$/;/' | \
sed 's/allow */subnet -> /g'
Resolves domain name from dns.google.com with curl and jq
_dname="google.com" ; curl -s "https://dns.google.com/resolve?name=${_dname}&type=A" | jq .
python
Tool:Static HTTP web server
# Python 3.x
python3 -m http.server 8000 --bind 127.0.0.1
# Python 2.x
python -m SimpleHTTPServer 8000
Static HTTP web server with SSL support
# Python 3.x
from http.server import HTTPServer, BaseHTTPRequestHandler
import ssl
httpd = HTTPServer(('localhost', 4443), BaseHTTPRequestHandler)
httpd.socket = ssl.wrap_socket (httpd.socket,
keyfile="path/to/key.pem",
certfile='path/to/cert.pem', server_side=True)
httpd.serve_forever()
# Python 2.x
import BaseHTTPServer, SimpleHTTPServer
import ssl
httpd = BaseHTTPServer.HTTPServer(('localhost', 4443),
SimpleHTTPServer.SimpleHTTPRequestHandler)
httpd.socket = ssl.wrap_socket (httpd.socket,
keyfile="path/tp/key.pem",
certfile='path/to/cert.pem', server_side=True)
httpd.serve_forever()
awk
Tool:Remove duplicate entries in a file without sorting
awk '!x[$0]++' filename
Exclude multiple columns using AWK
awk '{$1=$3=""}1' filename
Get the last hour of Apache logs
awk '/'$(date -d "1 hours ago" "+%d\\/%b\\/%Y:%H:%M")'/,/'$(date "+%d\\/%b\\/%Y:%H:%M")'/ { print $0 }' /var/log/httpd/access_log
sed
Tool:To print a specific line from a file
sed -n 10p /path/to/file
Remove a specific line from a file
sed -i 10d /path/to/file
# alternative (BSD): sed -i'' 10d /path/to/file
Remove a range of lines from a file
sed -i <file> -re '<start>,<end>d'
grep
Tool:Search for a "pattern" inside all files in the current directory
grep -rn "pattern"
grep -RnisI "pattern" *
fgrep "pattern" * -R
Remove blank lines from a file and save output to new file
grep . filename > newfilename
Except multiple patterns
grep -vE '(error|critical|warning)' filename
Show data from file without comments
grep -v ^[[:space:]]*# filename
Show data from file without comments and new lines
egrep -v '#|^$' filename